VirtualBox

source: vbox/trunk/include/iprt/formats/pecoff.h@ 93488

Last change on this file since 93488 was 93295, checked in by vboxsync, 3 years ago

IPRT/ldrPE,pecoff.h: Another IMAGE_LOAD_CONFIG_DIRECTORY field.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 120.6 KB
Line 
1/* $Id: pecoff.h 93295 2022-01-18 10:38:27Z vboxsync $ */
2/** @file
3 * IPRT - Windows NT PE & COFF Structures and Constants.
4 */
5
6/*
7 * Copyright (C) 2006-2022 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * The contents of this file may alternatively be used under the terms
18 * of the Common Development and Distribution License Version 1.0
19 * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20 * VirtualBox OSE distribution, in which case the provisions of the
21 * CDDL are applicable instead of those of the GPL.
22 *
23 * You may elect to license modified versions of this file under the
24 * terms and conditions of either the GPL or the CDDL or both.
25 */
26
27#ifndef IPRT_INCLUDED_formats_pecoff_h
28#define IPRT_INCLUDED_formats_pecoff_h
29#ifndef RT_WITHOUT_PRAGMA_ONCE
30# pragma once
31#endif
32
33#include <iprt/types.h>
34#include <iprt/assertcompile.h>
35
36
37/** @defgroup grp_rt_formats_pecoff PE & Microsoft COFF structures and definitions
38 * @ingroup grp_rt_formats
39 * @{
40 */
41
42
43/**
44 * PE & COFF file header.
45 *
46 * This starts COFF files, while in PE files it's preceeded by the PE signature
47 * (see IMAGE_NT_HEADERS32, IMAGE_NT_HEADERS64).
48 */
49typedef struct _IMAGE_FILE_HEADER
50{
51 uint16_t Machine; /**< 0x00 */
52 uint16_t NumberOfSections; /**< 0x02 */
53 uint32_t TimeDateStamp; /**< 0x04 */
54 uint32_t PointerToSymbolTable; /**< 0x08 */
55 uint32_t NumberOfSymbols; /**< 0x0c */
56 uint16_t SizeOfOptionalHeader; /**< 0x10 */
57 uint16_t Characteristics; /**< 0x12 */
58} IMAGE_FILE_HEADER; /* size: 0x14 */
59AssertCompileSize(IMAGE_FILE_HEADER, 0x14);
60typedef IMAGE_FILE_HEADER *PIMAGE_FILE_HEADER;
61typedef IMAGE_FILE_HEADER const *PCIMAGE_FILE_HEADER;
62
63
64/** @name PE & COFF machine types.
65 * Used by IMAGE_FILE_HEADER::Machine and IMAGE_SEPARATE_DEBUG_HEADER::Machine.
66 * @{ */
67/** X86 compatible CPU, 32-bit instructions. */
68#define IMAGE_FILE_MACHINE_I386 UINT16_C(0x014c)
69/** AMD64 compatible CPU, 64-bit instructions. */
70#define IMAGE_FILE_MACHINE_AMD64 UINT16_C(0x8664)
71
72/** Unknown target CPU. */
73#define IMAGE_FILE_MACHINE_UNKNOWN UINT16_C(0x0000)
74/** Basic-16 (whatever that is). */
75#define IMAGE_FILE_MACHINE_BASIC_16 UINT16_C(0x0142)
76/** Basic-16 (whatever that is) w/ transfer vector(s?) (TV). */
77#define IMAGE_FILE_MACHINE_BASIC_16_TV UINT16_C(0x0143)
78/** Intel iAPX 16 (8086?). */
79#define IMAGE_FILE_MACHINE_IAPX16 UINT16_C(0x0144)
80/** Intel iAPX 16 (8086?) w/ transfer vector(s?) (TV). */
81#define IMAGE_FILE_MACHINE_IAPX16_TV UINT16_C(0x0145)
82/** Intel iAPX 20 (80286?). */
83#define IMAGE_FILE_MACHINE_IAPX20 UINT16_C(0x0144)
84/** Intel iAPX 20 (80286?) w/ transfer vector(s?) (TV). */
85#define IMAGE_FILE_MACHINE_IAPX20_TV UINT16_C(0x0145)
86/** X86 compatible CPU, 8086. */
87#define IMAGE_FILE_MACHINE_I8086 UINT16_C(0x0148)
88/** X86 compatible CPU, 8086 w/ transfer vector(s?) (TV). */
89#define IMAGE_FILE_MACHINE_I8086_TV UINT16_C(0x0149)
90/** X86 compatible CPU, 80286 small model program. */
91#define IMAGE_FILE_MACHINE_I286_SMALL UINT16_C(0x014a)
92/** Motorola 68000. */
93#define IMAGE_FILE_MACHINE_MC68 UINT16_C(0x0150)
94/** Motorola 68000 w/ writable text sections. */
95#define IMAGE_FILE_MACHINE_MC68_WR UINT16_C(0x0150)
96/** Motorola 68000 w/ transfer vector(s?). */
97#define IMAGE_FILE_MACHINE_MC68_TV UINT16_C(0x0151)
98/** Motorola 68000 w/ demand paged text.
99 * @note shared with 80286 large model program. */
100#define IMAGE_FILE_MACHINE_MC68_PG UINT16_C(0x0152)
101/** X86 compatible CPU, 80286 large model program.
102 * @note shared with MC68000 w/ demand paged text */
103#define IMAGE_FILE_MACHINE_I286_LARGE UINT16_C(0x0152)
104/** IBM 370 (writable text). */
105#define IMAGE_FILE_MACHINE_U370_WR UINT16_C(0x0158)
106/** Amdahl 470/580 (writable text). */
107#define IMAGE_FILE_MACHINE_AMDAHL_470_WR UINT16_C(0x0159)
108/** Amdahl 470/580 (read only text). */
109#define IMAGE_FILE_MACHINE_AMDAHL_470_RO UINT16_C(0x015c)
110/** IBM 370 (read only text). */
111#define IMAGE_FILE_MACHINE_U370_RO UINT16_C(0x015d)
112/** MIPS R4000 CPU, little endian. */
113#define IMAGE_FILE_MACHINE_R4000 UINT16_C(0x0166)
114/** MIPS CPU, little endian, Windows CE (?) v2 designation. */
115#define IMAGE_FILE_MACHINE_WCEMIPSV2 UINT16_C(0x0169)
116/** VAX-11/750 and VAX-11/780 (writable text). */
117#define IMAGE_FILE_MACHINE_VAX_WR UINT16_C(0x0178)
118/** VAX-11/750 and VAX-11/780 (read-only text). */
119#define IMAGE_FILE_MACHINE_VAX_RO UINT16_C(0x017d)
120/** Hitachi SH3 CPU. */
121#define IMAGE_FILE_MACHINE_SH3 UINT16_C(0x01a2)
122/** Hitachi SH3 DSP. */
123#define IMAGE_FILE_MACHINE_SH3DSP UINT16_C(0x01a3)
124/** Hitachi SH4 CPU. */
125#define IMAGE_FILE_MACHINE_SH4 UINT16_C(0x01a6)
126/** Hitachi SH5 CPU. */
127#define IMAGE_FILE_MACHINE_SH5 UINT16_C(0x01a8)
128/** Little endian ARM CPU. */
129#define IMAGE_FILE_MACHINE_ARM UINT16_C(0x01c0)
130/** ARM or Thumb stuff. */
131#define IMAGE_FILE_MACHINE_THUMB UINT16_C(0x01c2)
132/** ARMv7 or higher CPU, Thumb mode. */
133#define IMAGE_FILE_MACHINE_ARMNT UINT16_C(0x01c4)
134/** Matshushita AM33 CPU. */
135#define IMAGE_FILE_MACHINE_AM33 UINT16_C(0x01d3)
136/** Power PC CPU, little endian. */
137#define IMAGE_FILE_MACHINE_POWERPC UINT16_C(0x01f0)
138/** Power PC CPU with FPU, also little endian? */
139#define IMAGE_FILE_MACHINE_POWERPCFP UINT16_C(0x01f1)
140/** "Itanic" CPU. */
141#define IMAGE_FILE_MACHINE_IA64 UINT16_C(0x0200)
142/** MIPS CPU, compact 16-bit instructions only? */
143#define IMAGE_FILE_MACHINE_MIPS16 UINT16_C(0x0266)
144/** MIPS CPU with FPU, full 32-bit instructions only? */
145#define IMAGE_FILE_MACHINE_MIPSFPU UINT16_C(0x0366)
146/** MIPS CPU with FPU, compact 16-bit instructions? */
147#define IMAGE_FILE_MACHINE_MIPSFPU16 UINT16_C(0x0466)
148/** EFI byte code. */
149#define IMAGE_FILE_MACHINE_EBC UINT16_C(0x0ebc)
150/** Mitsubishi M32R CPU, little endian. */
151#define IMAGE_FILE_MACHINE_M32R UINT16_C(0x9041)
152/** ARMv8 CPU, 64-bit mode. */
153#define IMAGE_FILE_MACHINE_ARM64 UINT16_C(0xaa64)
154/** @} */
155
156/** @name File header characteristics (IMAGE_FILE_HEADER::Characteristics)
157 * @{ */
158#define IMAGE_FILE_RELOCS_STRIPPED UINT16_C(0x0001)
159#define IMAGE_FILE_EXECUTABLE_IMAGE UINT16_C(0x0002)
160#define IMAGE_FILE_LINE_NUMS_STRIPPED UINT16_C(0x0004)
161#define IMAGE_FILE_LOCAL_SYMS_STRIPPED UINT16_C(0x0008)
162#define IMAGE_FILE_AGGRESIVE_WS_TRIM UINT16_C(0x0010)
163#define IMAGE_FILE_LARGE_ADDRESS_AWARE UINT16_C(0x0020)
164#define IMAGE_FILE_16BIT_MACHINE UINT16_C(0x0040)
165#define IMAGE_FILE_BYTES_REVERSED_LO UINT16_C(0x0080)
166#define IMAGE_FILE_32BIT_MACHINE UINT16_C(0x0100)
167#define IMAGE_FILE_DEBUG_STRIPPED UINT16_C(0x0200)
168#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP UINT16_C(0x0400)
169#define IMAGE_FILE_NET_RUN_FROM_SWAP UINT16_C(0x0800)
170#define IMAGE_FILE_SYSTEM UINT16_C(0x1000) /**< (COFF/IAPX*: Used to indicate 80186 instructions) */
171#define IMAGE_FILE_DLL UINT16_C(0x2000) /**< (COFF/IAPX*: Used to indicate 80286 instructions) */
172#define IMAGE_FILE_UP_SYSTEM_ONLY UINT16_C(0x4000)
173#define IMAGE_FILE_BYTES_REVERSED_HI UINT16_C(0x8000)
174/** @} */
175
176
177/**
178 * PE data directory.
179 *
180 * This is used to locate data in the loaded image so the dynamic linker or
181 * others can make use of it. However, in the case of
182 * IMAGE_DIRECTORY_ENTRY_SECURITY it is referring to raw file offsets.
183 */
184typedef struct _IMAGE_DATA_DIRECTORY
185{
186 uint32_t VirtualAddress;
187 uint32_t Size;
188} IMAGE_DATA_DIRECTORY;
189AssertCompileSize(IMAGE_DATA_DIRECTORY, 0x8);
190typedef IMAGE_DATA_DIRECTORY *PIMAGE_DATA_DIRECTORY;
191typedef IMAGE_DATA_DIRECTORY const *PCIMAGE_DATA_DIRECTORY;
192
193/** The standard number of data directories in the optional header.
194 * I.e. the dimensions of IMAGE_OPTIONAL_HEADER32::DataDirectory and
195 * IMAGE_OPTIONAL_HEADER64::DataDirectory.
196 */
197#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 0x10
198
199
200/**
201 * PE optional header, 32-bit version.
202 */
203typedef struct _IMAGE_OPTIONAL_HEADER32
204{
205 uint16_t Magic; /**< 0x00 */
206 uint8_t MajorLinkerVersion; /**< 0x02 */
207 uint8_t MinorLinkerVersion; /**< 0x03 */
208 uint32_t SizeOfCode; /**< 0x04 */
209 uint32_t SizeOfInitializedData; /**< 0x08 */
210 uint32_t SizeOfUninitializedData; /**< 0x0c */
211 uint32_t AddressOfEntryPoint; /**< 0x10 */
212 uint32_t BaseOfCode; /**< 0x14 */
213 uint32_t BaseOfData; /**< 0x18 */
214 uint32_t ImageBase; /**< 0x1c */
215 uint32_t SectionAlignment; /**< 0x20 */
216 uint32_t FileAlignment; /**< 0x24 */
217 uint16_t MajorOperatingSystemVersion; /**< 0x28 */
218 uint16_t MinorOperatingSystemVersion; /**< 0x2a */
219 uint16_t MajorImageVersion; /**< 0x2c */
220 uint16_t MinorImageVersion; /**< 0x2e */
221 uint16_t MajorSubsystemVersion; /**< 0x30 */
222 uint16_t MinorSubsystemVersion; /**< 0x32 */
223 uint32_t Win32VersionValue; /**< 0x34 */
224 uint32_t SizeOfImage; /**< 0x38 */
225 uint32_t SizeOfHeaders; /**< 0x3c */
226 uint32_t CheckSum; /**< 0x40 */
227 uint16_t Subsystem; /**< 0x44 */
228 uint16_t DllCharacteristics; /**< 0x46 */
229 uint32_t SizeOfStackReserve; /**< 0x48 */
230 uint32_t SizeOfStackCommit; /**< 0x4c */
231 uint32_t SizeOfHeapReserve; /**< 0x50 */
232 uint32_t SizeOfHeapCommit; /**< 0x54 */
233 uint32_t LoaderFlags; /**< 0x58 */
234 uint32_t NumberOfRvaAndSizes; /**< 0x5c */
235 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x60; 0x10*8 = 0x80 */
236} IMAGE_OPTIONAL_HEADER32; /* size: 0xe0 */
237AssertCompileSize(IMAGE_OPTIONAL_HEADER32, 0xe0);
238typedef IMAGE_OPTIONAL_HEADER32 *PIMAGE_OPTIONAL_HEADER32;
239typedef IMAGE_OPTIONAL_HEADER32 const *PCIMAGE_OPTIONAL_HEADER32;
240
241/**
242 * PE optional header, 64-bit version.
243 */
244typedef struct _IMAGE_OPTIONAL_HEADER64
245{
246 uint16_t Magic; /**< 0x00 */
247 uint8_t MajorLinkerVersion; /**< 0x02 */
248 uint8_t MinorLinkerVersion; /**< 0x03 */
249 uint32_t SizeOfCode; /**< 0x04 */
250 uint32_t SizeOfInitializedData; /**< 0x08 */
251 uint32_t SizeOfUninitializedData; /**< 0x0c */
252 uint32_t AddressOfEntryPoint; /**< 0x10 */
253 uint32_t BaseOfCode; /**< 0x14 */
254 uint64_t ImageBase; /**< 0x18 */
255 uint32_t SectionAlignment; /**< 0x20 */
256 uint32_t FileAlignment; /**< 0x24 */
257 uint16_t MajorOperatingSystemVersion; /**< 0x28 */
258 uint16_t MinorOperatingSystemVersion; /**< 0x2a */
259 uint16_t MajorImageVersion; /**< 0x2c */
260 uint16_t MinorImageVersion; /**< 0x2e */
261 uint16_t MajorSubsystemVersion; /**< 0x30 */
262 uint16_t MinorSubsystemVersion; /**< 0x32 */
263 uint32_t Win32VersionValue; /**< 0x34 */
264 uint32_t SizeOfImage; /**< 0x38 */
265 uint32_t SizeOfHeaders; /**< 0x3c */
266 uint32_t CheckSum; /**< 0x40 */
267 uint16_t Subsystem; /**< 0x44 */
268 uint16_t DllCharacteristics; /**< 0x46 */
269 uint64_t SizeOfStackReserve; /**< 0x48 */
270 uint64_t SizeOfStackCommit; /**< 0x50 */
271 uint64_t SizeOfHeapReserve; /**< 0x58 */
272 uint64_t SizeOfHeapCommit; /**< 0x60 */
273 uint32_t LoaderFlags; /**< 0x68 */
274 uint32_t NumberOfRvaAndSizes; /**< 0x6c */
275 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x70; 0x10*8 = 0x80 */
276} IMAGE_OPTIONAL_HEADER64; /* size: 0xf0 */
277AssertCompileSize(IMAGE_OPTIONAL_HEADER64, 0xf0);
278typedef IMAGE_OPTIONAL_HEADER64 *PIMAGE_OPTIONAL_HEADER64;
279typedef IMAGE_OPTIONAL_HEADER64 const *PCIMAGE_OPTIONAL_HEADER64;
280
281/** @name Optional header magic values.
282 * @{ */
283#define IMAGE_NT_OPTIONAL_HDR32_MAGIC UINT16_C(0x010b)
284#define IMAGE_NT_OPTIONAL_HDR64_MAGIC UINT16_C(0x020b)
285/** @} */
286
287/** @name IMAGE_SUBSYSTEM_XXX - Optional header subsystems.
288 * IMAGE_OPTIONAL_HEADER32::Subsystem, IMAGE_OPTIONAL_HEADER64::Subsystem
289 * @{ */
290#define IMAGE_SUBSYSTEM_UNKNOWN UINT16_C(0x0000)
291#define IMAGE_SUBSYSTEM_NATIVE UINT16_C(0x0001)
292#define IMAGE_SUBSYSTEM_WINDOWS_GUI UINT16_C(0x0002)
293#define IMAGE_SUBSYSTEM_WINDOWS_CUI UINT16_C(0x0003)
294#define IMAGE_SUBSYSTEM_OS2_GUI UINT16_C(0x0004)
295#define IMAGE_SUBSYSTEM_OS2_CUI UINT16_C(0x0005)
296#define IMAGE_SUBSYSTEM_POSIX_CUI UINT16_C(0x0007)
297/** @} */
298
299/** @name Optional header characteristics.
300 * @{ */
301#define IMAGE_LIBRARY_PROCESS_INIT UINT16_C(0x0001)
302#define IMAGE_LIBRARY_PROCESS_TERM UINT16_C(0x0002)
303#define IMAGE_LIBRARY_THREAD_INIT UINT16_C(0x0004)
304#define IMAGE_LIBRARY_THREAD_TERM UINT16_C(0x0008)
305#define IMAGE_DLLCHARACTERISTICS_RESERVED UINT16_C(0x0010)
306#define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA UINT16_C(0x0020)
307#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE UINT16_C(0x0040)
308#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY UINT16_C(0x0080)
309#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT UINT16_C(0x0100)
310#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION UINT16_C(0x0200)
311#define IMAGE_DLLCHARACTERISTICS_NO_SEH UINT16_C(0x0400)
312#define IMAGE_DLLCHARACTERISTICS_NO_BIND UINT16_C(0x0800)
313#define IMAGE_DLLCHARACTERISTICS_APPCONTAINER UINT16_C(0x1000)
314#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER UINT16_C(0x2000)
315#define IMAGE_DLLCHARACTERISTICS_GUARD_CF UINT16_C(0x4000)
316#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE UINT16_C(0x8000)
317/** @} */
318
319
320/** @name IMAGE_DIRECTORY_ENTRY_XXX - Data directory indexes.
321 * Used to index IMAGE_OPTIONAL_HEADER32::DataDirectory and
322 * IMAGE_OPTIONAL_HEADER64::DataDirectory
323 * @{ */
324#define IMAGE_DIRECTORY_ENTRY_EXPORT 0x0
325#define IMAGE_DIRECTORY_ENTRY_IMPORT 0x1
326#define IMAGE_DIRECTORY_ENTRY_RESOURCE 0x2
327#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x3
328#define IMAGE_DIRECTORY_ENTRY_SECURITY 0x4
329#define IMAGE_DIRECTORY_ENTRY_BASERELOC 0x5
330#define IMAGE_DIRECTORY_ENTRY_DEBUG 0x6
331#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 0x7
332#define IMAGE_DIRECTORY_ENTRY_COPYRIGHT IMAGE_DIRECTORY_ENTRY_ARCHITECTURE
333#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x8
334#define IMAGE_DIRECTORY_ENTRY_TLS 0x9
335#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0xa
336#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0xb
337#define IMAGE_DIRECTORY_ENTRY_IAT 0xc
338#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0xd
339#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0xe
340/** @} */
341
342
343/**
344 * PE (NT) headers, 32-bit version.
345 */
346typedef struct _IMAGE_NT_HEADERS32
347{
348 uint32_t Signature; /**< 0x00 */
349 IMAGE_FILE_HEADER FileHeader; /**< 0x04 */
350 IMAGE_OPTIONAL_HEADER32 OptionalHeader; /**< 0x18 */
351} IMAGE_NT_HEADERS32; /* size: 0xf8 */
352AssertCompileSize(IMAGE_NT_HEADERS32, 0xf8);
353AssertCompileMemberOffset(IMAGE_NT_HEADERS32, FileHeader, 4);
354AssertCompileMemberOffset(IMAGE_NT_HEADERS32, OptionalHeader, 24);
355typedef IMAGE_NT_HEADERS32 *PIMAGE_NT_HEADERS32;
356typedef IMAGE_NT_HEADERS32 const *PCIMAGE_NT_HEADERS32;
357
358/**
359 * PE (NT) headers, 64-bit version.
360 */
361typedef struct _IMAGE_NT_HEADERS64
362{
363 uint32_t Signature; /**< 0x00 */
364 IMAGE_FILE_HEADER FileHeader; /**< 0x04 */
365 IMAGE_OPTIONAL_HEADER64 OptionalHeader; /**< 0x18 */
366} IMAGE_NT_HEADERS64; /**< 0x108 */
367AssertCompileSize(IMAGE_NT_HEADERS64, 0x108);
368AssertCompileMemberOffset(IMAGE_NT_HEADERS64, FileHeader, 4);
369AssertCompileMemberOffset(IMAGE_NT_HEADERS64, OptionalHeader, 24);
370typedef IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
371typedef IMAGE_NT_HEADERS64 const *PCIMAGE_NT_HEADERS64;
372
373/** The PE signature.
374 * Used by IMAGE_NT_HEADERS32::Signature, IMAGE_NT_HEADERS64::Signature. */
375#define IMAGE_NT_SIGNATURE UINT32_C(0x00004550)
376
377
378/** Section header short name length (IMAGE_SECTION_HEADER::Name). */
379#define IMAGE_SIZEOF_SHORT_NAME 0x8
380
381/**
382 * PE & COFF section header.
383 */
384typedef struct _IMAGE_SECTION_HEADER
385{
386 uint8_t Name[IMAGE_SIZEOF_SHORT_NAME];
387 union
388 {
389 uint32_t PhysicalAddress;
390 uint32_t VirtualSize;
391 } Misc;
392 uint32_t VirtualAddress;
393 uint32_t SizeOfRawData;
394 uint32_t PointerToRawData;
395 uint32_t PointerToRelocations;
396 uint32_t PointerToLinenumbers;
397 uint16_t NumberOfRelocations;
398 uint16_t NumberOfLinenumbers;
399 uint32_t Characteristics;
400} IMAGE_SECTION_HEADER;
401AssertCompileSize(IMAGE_SECTION_HEADER, 40);
402typedef IMAGE_SECTION_HEADER *PIMAGE_SECTION_HEADER;
403typedef IMAGE_SECTION_HEADER const *PCIMAGE_SECTION_HEADER;
404
405/** @name IMAGE_SCN_XXX - Section header characteristics.
406 * Used by IMAGE_SECTION_HEADER::Characteristics.
407 * @{ */
408#define IMAGE_SCN_TYPE_REG UINT32_C(0x00000000)
409#define IMAGE_SCN_TYPE_DSECT UINT32_C(0x00000001)
410#define IMAGE_SCN_TYPE_NOLOAD UINT32_C(0x00000002)
411#define IMAGE_SCN_TYPE_GROUP UINT32_C(0x00000004)
412#define IMAGE_SCN_TYPE_NO_PAD UINT32_C(0x00000008)
413#define IMAGE_SCN_TYPE_COPY UINT32_C(0x00000010)
414
415#define IMAGE_SCN_CNT_CODE UINT32_C(0x00000020)
416#define IMAGE_SCN_CNT_INITIALIZED_DATA UINT32_C(0x00000040)
417#define IMAGE_SCN_CNT_UNINITIALIZED_DATA UINT32_C(0x00000080)
418
419#define IMAGE_SCN_LNK_OTHER UINT32_C(0x00000100)
420#define IMAGE_SCN_LNK_INFO UINT32_C(0x00000200)
421#define IMAGE_SCN_TYPE_OVER UINT32_C(0x00000400)
422#define IMAGE_SCN_LNK_REMOVE UINT32_C(0x00000800)
423#define IMAGE_SCN_LNK_COMDAT UINT32_C(0x00001000)
424#define IMAGE_SCN_MEM_PROTECTED UINT32_C(0x00004000)
425#define IMAGE_SCN_NO_DEFER_SPEC_EXC UINT32_C(0x00004000)
426#define IMAGE_SCN_GPREL UINT32_C(0x00008000)
427#define IMAGE_SCN_MEM_FARDATA UINT32_C(0x00008000)
428#define IMAGE_SCN_MEM_SYSHEAP UINT32_C(0x00010000)
429#define IMAGE_SCN_MEM_PURGEABLE UINT32_C(0x00020000)
430#define IMAGE_SCN_MEM_16BIT UINT32_C(0x00020000)
431#define IMAGE_SCN_MEM_LOCKED UINT32_C(0x00040000)
432#define IMAGE_SCN_MEM_PRELOAD UINT32_C(0x00080000)
433
434#define IMAGE_SCN_ALIGN_1BYTES UINT32_C(0x00100000)
435#define IMAGE_SCN_ALIGN_2BYTES UINT32_C(0x00200000)
436#define IMAGE_SCN_ALIGN_4BYTES UINT32_C(0x00300000)
437#define IMAGE_SCN_ALIGN_8BYTES UINT32_C(0x00400000)
438#define IMAGE_SCN_ALIGN_16BYTES UINT32_C(0x00500000)
439#define IMAGE_SCN_ALIGN_32BYTES UINT32_C(0x00600000)
440#define IMAGE_SCN_ALIGN_64BYTES UINT32_C(0x00700000)
441#define IMAGE_SCN_ALIGN_128BYTES UINT32_C(0x00800000)
442#define IMAGE_SCN_ALIGN_256BYTES UINT32_C(0x00900000)
443#define IMAGE_SCN_ALIGN_512BYTES UINT32_C(0x00A00000)
444#define IMAGE_SCN_ALIGN_1024BYTES UINT32_C(0x00B00000)
445#define IMAGE_SCN_ALIGN_2048BYTES UINT32_C(0x00C00000)
446#define IMAGE_SCN_ALIGN_4096BYTES UINT32_C(0x00D00000)
447#define IMAGE_SCN_ALIGN_8192BYTES UINT32_C(0x00E00000)
448#define IMAGE_SCN_ALIGN_MASK UINT32_C(0x00F00000)
449#define IMAGE_SCN_ALIGN_SHIFT 20
450
451#define IMAGE_SCN_LNK_NRELOC_OVFL UINT32_C(0x01000000)
452#define IMAGE_SCN_MEM_DISCARDABLE UINT32_C(0x02000000)
453#define IMAGE_SCN_MEM_NOT_CACHED UINT32_C(0x04000000)
454#define IMAGE_SCN_MEM_NOT_PAGED UINT32_C(0x08000000)
455#define IMAGE_SCN_MEM_SHARED UINT32_C(0x10000000)
456#define IMAGE_SCN_MEM_EXECUTE UINT32_C(0x20000000)
457#define IMAGE_SCN_MEM_READ UINT32_C(0x40000000)
458#define IMAGE_SCN_MEM_WRITE UINT32_C(0x80000000)
459/** @} */
460
461
462/**
463 * PE image base relocations block header.
464 *
465 * This found in IMAGE_DIRECTORY_ENTRY_BASERELOC. Each entry is follow
466 * immediately by an array of 16-bit words, where the lower 12-bits are used
467 * for the page offset and the upper 4-bits for the base relocation type
468 * (IMAGE_REL_BASE_XXX). The block should be padded with
469 * IMAGE_REL_BASED_ABSOLUTE entries to ensure 32-bit alignment of this header.
470 */
471typedef struct _IMAGE_BASE_RELOCATION
472{
473 /** The RVA of the page/block the following ase relocations applies to. */
474 uint32_t VirtualAddress;
475 /** The size of this relocation block, including this header. */
476 uint32_t SizeOfBlock;
477} IMAGE_BASE_RELOCATION;
478AssertCompileSize(IMAGE_BASE_RELOCATION, 8);
479typedef IMAGE_BASE_RELOCATION *PIMAGE_BASE_RELOCATION;
480typedef IMAGE_BASE_RELOCATION const *PCIMAGE_BASE_RELOCATION;
481
482/** @name IMAGE_REL_BASED_XXX - PE base relocations.
483 * Found in the IMAGE_DIRECTORY_ENTRY_BASERELOC data directory.
484 * @{ */
485#define IMAGE_REL_BASED_ABSOLUTE UINT16_C(0x0)
486#define IMAGE_REL_BASED_HIGH UINT16_C(0x1)
487#define IMAGE_REL_BASED_LOW UINT16_C(0x2)
488#define IMAGE_REL_BASED_HIGHLOW UINT16_C(0x3)
489#define IMAGE_REL_BASED_HIGHADJ UINT16_C(0x4)
490#define IMAGE_REL_BASED_MIPS_JMPADDR UINT16_C(0x5)
491#define IMAGE_REL_BASED_MIPS_JMPADDR16 UINT16_C(0x9)
492#define IMAGE_REL_BASED_IA64_IMM64 UINT16_C(0x9)
493#define IMAGE_REL_BASED_DIR64 UINT16_C(0xa)
494#define IMAGE_REL_BASED_HIGH3ADJ UINT16_C(0xb)
495/** @} */
496
497/**
498 * PE export directory entry.
499 */
500typedef struct _IMAGE_EXPORT_DIRECTORY
501{
502 uint32_t Characteristics;
503 uint32_t TimeDateStamp;
504 uint16_t MajorVersion;
505 uint16_t MinorVersion;
506 uint32_t Name;
507 uint32_t Base;
508 uint32_t NumberOfFunctions;
509 uint32_t NumberOfNames;
510 uint32_t AddressOfFunctions;
511 uint32_t AddressOfNames;
512 uint32_t AddressOfNameOrdinals;
513} IMAGE_EXPORT_DIRECTORY;
514AssertCompileSize(IMAGE_EXPORT_DIRECTORY, 40);
515typedef IMAGE_EXPORT_DIRECTORY *PIMAGE_EXPORT_DIRECTORY;
516typedef IMAGE_EXPORT_DIRECTORY const *PCIMAGE_EXPORT_DIRECTORY;
517
518
519/**
520 * PE import directory entry.
521 */
522typedef struct _IMAGE_IMPORT_DESCRIPTOR
523{
524 union
525 {
526 uint32_t Characteristics;
527 uint32_t OriginalFirstThunk;
528 } u;
529 uint32_t TimeDateStamp;
530 uint32_t ForwarderChain;
531 uint32_t Name;
532 uint32_t FirstThunk;
533} IMAGE_IMPORT_DESCRIPTOR;
534AssertCompileSize(IMAGE_IMPORT_DESCRIPTOR, 20);
535typedef IMAGE_IMPORT_DESCRIPTOR *PIMAGE_IMPORT_DESCRIPTOR;
536typedef IMAGE_IMPORT_DESCRIPTOR const *PCIMAGE_IMPORT_DESCRIPTOR;
537
538/**
539 * Something we currently don't make use of...
540 */
541typedef struct _IMAGE_IMPORT_BY_NAME
542{
543 uint16_t Hint;
544 uint8_t Name[1];
545} IMAGE_IMPORT_BY_NAME;
546AssertCompileSize(IMAGE_IMPORT_BY_NAME, 4);
547typedef IMAGE_IMPORT_BY_NAME *PIMAGE_IMPORT_BY_NAME;
548typedef IMAGE_IMPORT_BY_NAME const *PCIMAGE_IMPORT_BY_NAME;
549
550
551#if 0
552/* The image_thunk_data32/64 structures are not very helpful except for getting RSI.
553 keep them around till all the code has been converted. */
554typedef struct _IMAGE_THUNK_DATA64
555{
556 union
557 {
558 uint64_t ForwarderString;
559 uint64_t Function;
560 uint64_t Ordinal;
561 uint64_t AddressOfData;
562 } u1;
563} IMAGE_THUNK_DATA64;
564typedef IMAGE_THUNK_DATA64 *PIMAGE_THUNK_DATA64;
565typedef IMAGE_THUNK_DATA64 const *PCIMAGE_THUNK_DATA64;
566
567typedef struct _IMAGE_THUNK_DATA32
568{
569 union
570 {
571 uint32_t ForwarderString;
572 uint32_t Function;
573 uint32_t Ordinal;
574 uint32_t AddressOfData;
575 } u1;
576} IMAGE_THUNK_DATA32;
577typedef IMAGE_THUNK_DATA32 *PIMAGE_THUNK_DATA32;
578typedef IMAGE_THUNK_DATA32 const *PCIMAGE_THUNK_DATA32;
579#endif
580
581/** @name PE import directory macros.
582 * @{ */
583#define IMAGE_ORDINAL_FLAG32 UINT32_C(0x80000000)
584#define IMAGE_ORDINAL32(ord) ((ord) & UINT32_C(0xffff))
585#define IMAGE_SNAP_BY_ORDINAL32(ord) (!!((ord) & IMAGE_ORDINAL_FLAG32))
586
587#define IMAGE_ORDINAL_FLAG64 UINT64_C(0x8000000000000000)
588#define IMAGE_ORDINAL64(ord) ((ord) & UINT32_C(0xffff))
589#define IMAGE_SNAP_BY_ORDINAL64(ord) (!!((ord) & IMAGE_ORDINAL_FLAG64))
590/** @} */
591
592/** @name PE Resource directory
593 * @{ */
594typedef struct _IMAGE_RESOURCE_DIRECTORY
595{
596 uint32_t Characteristics;
597 uint32_t TimeDateStamp;
598 uint16_t MajorVersion;
599 uint16_t MinorVersion;
600 uint16_t NumberOfNamedEntries;
601 uint16_t NumberOfIdEntries;
602} IMAGE_RESOURCE_DIRECTORY;
603typedef IMAGE_RESOURCE_DIRECTORY *PIMAGE_RESOURCE_DIRECTORY;
604typedef IMAGE_RESOURCE_DIRECTORY const *PCIMAGE_RESOURCE_DIRECTORY;
605
606typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY
607{
608 union
609 {
610 struct
611 {
612 uint32_t NameOffset : 31;
613 uint32_t NameIsString : 1; /**< IMAGE_RESOURCE_NAME_IS_STRING */
614 } s;
615 uint32_t Name;
616 uint16_t Id;
617 } u;
618 union
619 {
620 struct
621 {
622 uint32_t OffsetToDirectory : 31;
623 uint32_t DataIsDirectory : 1; /**< IMAGE_RESOURCE_DATA_IS_DIRECTORY*/
624 } s2;
625 uint32_t OffsetToData;
626 } u2;
627} IMAGE_RESOURCE_DIRECTORY_ENTRY;
628typedef IMAGE_RESOURCE_DIRECTORY_ENTRY *PIMAGE_RESOURCE_DIRECTORY_ENTRY;
629typedef IMAGE_RESOURCE_DIRECTORY_ENTRY const *PCIMAGE_RESOURCE_DIRECTORY_ENTRY;
630
631#define IMAGE_RESOURCE_NAME_IS_STRING UINT32_C(0x80000000)
632#define IMAGE_RESOURCE_DATA_IS_DIRECTORY UINT32_C(0x80000000)
633
634typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING
635{
636 uint16_t Length;
637 char NameString[1];
638} IMAGE_RESOURCE_DIRECTORY_STRING;
639typedef IMAGE_RESOURCE_DIRECTORY_STRING *PIMAGE_RESOURCE_DIRECTORY_STRING;
640typedef IMAGE_RESOURCE_DIRECTORY_STRING const *PCIMAGE_RESOURCE_DIRECTORY_STRING;
641
642
643typedef struct _IMAGE_RESOURCE_DIR_STRING_U
644{
645 uint16_t Length;
646 RTUTF16 NameString[1];
647} IMAGE_RESOURCE_DIR_STRING_U;
648typedef IMAGE_RESOURCE_DIR_STRING_U *PIMAGE_RESOURCE_DIR_STRING_U;
649typedef IMAGE_RESOURCE_DIR_STRING_U const *PCIMAGE_RESOURCE_DIR_STRING_U;
650
651
652typedef struct _IMAGE_RESOURCE_DATA_ENTRY
653{
654 uint32_t OffsetToData;
655 uint32_t Size;
656 uint32_t CodePage;
657 uint32_t Reserved;
658} IMAGE_RESOURCE_DATA_ENTRY;
659typedef IMAGE_RESOURCE_DATA_ENTRY *PIMAGE_RESOURCE_DATA_ENTRY;
660typedef IMAGE_RESOURCE_DATA_ENTRY const *PCIMAGE_RESOURCE_DATA_ENTRY;
661
662/** @} */
663
664/** @name Image exception information
665 * @{ */
666
667/** This structure is used by AMD64 and "Itanic".
668 * MIPS uses a different one. ARM, SH3, SH4 and PPC on WinCE also uses a different one. */
669typedef struct _IMAGE_RUNTIME_FUNCTION_ENTRY
670{
671 uint32_t BeginAddress;
672 uint32_t EndAddress;
673 uint32_t UnwindInfoAddress;
674} IMAGE_RUNTIME_FUNCTION_ENTRY;
675AssertCompileSize(IMAGE_RUNTIME_FUNCTION_ENTRY, 12);
676typedef IMAGE_RUNTIME_FUNCTION_ENTRY *PIMAGE_RUNTIME_FUNCTION_ENTRY;
677typedef IMAGE_RUNTIME_FUNCTION_ENTRY const *PCIMAGE_RUNTIME_FUNCTION_ENTRY;
678
679/**
680 * An unwind code for AMD64 and ARM64.
681 *
682 * @note Also known as UNWIND_CODE or _UNWIND_CODE.
683 */
684typedef union IMAGE_UNWIND_CODE
685{
686 struct
687 {
688 /** The prolog offset where the change takes effect.
689 * This means the instruction following the one being described. */
690 uint8_t CodeOffset;
691 /** Unwind opcode.
692 * For AMD64 see IMAGE_AMD64_UNWIND_OP_CODES. */
693 RT_GCC_EXTENSION uint8_t UnwindOp : 4;
694 /** Opcode specific. */
695 RT_GCC_EXTENSION uint8_t OpInfo : 4;
696 } u;
697 uint16_t FrameOffset;
698} IMAGE_UNWIND_CODE;
699AssertCompileSize(IMAGE_UNWIND_CODE, 2);
700
701/**
702 * Unwind information for AMD64 and ARM64.
703 *
704 * Pointed to by IMAGE_RUNTIME_FUNCTION_ENTRY::UnwindInfoAddress,
705 *
706 * @note Also known as UNWIND_INFO or _UNWIND_INFO.
707 */
708typedef struct IMAGE_UNWIND_INFO
709{
710 /** Version, currently 1 or 2. The latter if IMAGE_AMD64_UWOP_EPILOG is used. */
711 RT_GCC_EXTENSION uint8_t Version : 3;
712 /** IMAGE_UNW_FLAG_XXX */
713 RT_GCC_EXTENSION uint8_t Flags : 5;
714 /** Size of function prolog. */
715 uint8_t SizeOfProlog;
716 /** Number of opcodes in aOpcodes. */
717 uint8_t CountOfCodes;
718 /** Initial frame register. */
719 RT_GCC_EXTENSION uint8_t FrameRegister : 4;
720 /** Scaled frame register offset. */
721 RT_GCC_EXTENSION uint8_t FrameOffset : 4;
722 /** Unwind opcodes. */
723 RT_FLEXIBLE_ARRAY_EXTENSION
724 IMAGE_UNWIND_CODE aOpcodes[RT_FLEXIBLE_ARRAY];
725} IMAGE_UNWIND_INFO;
726AssertCompileMemberOffset(IMAGE_UNWIND_INFO, aOpcodes, 4);
727typedef IMAGE_UNWIND_INFO *PIMAGE_UNWIND_INFO;
728typedef IMAGE_UNWIND_INFO const *PCIMAGE_UNWIND_INFO;
729
730/** IMAGE_UNW_FLAGS_XXX - IMAGE_UNWIND_INFO::Flags.
731 * @{ */
732/** No handler.
733 * @note Aslo know as UNW_FLAG_NHANDLER. */
734#define IMAGE_UNW_FLAGS_NHANDLER 0
735/** Have exception handler (RVA after codes, dword aligned.)
736 * @note Aslo know as UNW_FLAG_NHANDLER. */
737#define IMAGE_UNW_FLAGS_EHANDLER 1
738/** Have unwind handler (RVA after codes, dword aligned.)
739 * @note Aslo know as UNW_FLAG_NHANDLER. */
740#define IMAGE_UNW_FLAGS_UHANDLER 2
741/** Set if not primary unwind info for a function. An
742 * IMAGE_RUNTIME_FUNCTION_ENTRY giving the chained unwind info follows the
743 * aOpcodes array at a dword aligned offset. */
744#define IMAGE_UNW_FLAGS_CHAININFO 4
745/** @} */
746
747/**
748 * AMD64 unwind opcodes.
749 */
750typedef enum IMAGE_AMD64_UNWIND_OP_CODES
751{
752 /** Push non-volatile register (OpInfo).
753 * YASM: [pushreg reg]
754 * MASM: .PUSHREG reg */
755 IMAGE_AMD64_UWOP_PUSH_NONVOL = 0,
756 /** Stack allocation: Size stored in scaled in the next slot if OpInfo == 0,
757 * otherwise stored unscaled in the next two slots.
758 * YASM: [allocstack size]
759 * MASM: .ALLOCSTACK size */
760 IMAGE_AMD64_UWOP_ALLOC_LARGE,
761 /** Stack allocation: OpInfo = size / 8 - 1.
762 * YASM: [allocstack size]
763 * MASM: .ALLOCSTACK size */
764 IMAGE_AMD64_UWOP_ALLOC_SMALL,
765 /** Set frame pointer register: RSP + FrameOffset * 16.
766 * YASM: [setframe reg, offset]
767 * MASM: .SETFRAME reg, offset
768 * @code
769 * LEA RBP, [RSP + 20h]
770 * [setframe RBP, 20h]
771 * @endcode */
772 IMAGE_AMD64_UWOP_SET_FPREG,
773 /** Save non-volatile register (OpInfo) on stack (RSP/FP + next slot).
774 * YASM: [savereg reg, offset]
775 * MASM: .SAVEREG reg, offset */
776 IMAGE_AMD64_UWOP_SAVE_NONVOL,
777 /** Save non-volatile register (OpInfo) on stack (RSP/FP + next two slots).
778 * YASM: [savereg reg, offset]
779 * MASM: .SAVEREG reg, offset */
780 IMAGE_AMD64_UWOP_SAVE_NONVOL_FAR,
781 /** Epilog info, version 2+.
782 *
783 * The first time this opcode is used, the CodeOffset gives the size of the
784 * epilog and bit 0 of the OpInfo field indicates that there is only one
785 * epilog at the very end of the function.
786 *
787 * Subsequent uses of this opcode specifies epilog start offsets relative to
788 * the end of the function, using CodeOffset for the 8 lower bits and OpInfo
789 * for bits 8 thru 11.
790 *
791 * The compiler seems to stack allocations and register saving opcodes and
792 * indicates the location mirroring the first IMAGE_AMD64_UWOP_PUSH_NONVOL. */
793 IMAGE_AMD64_UWOP_EPILOG,
794 /** Undefined. */
795 IMAGE_AMD64_UWOP_RESERVED_7,
796 /** Save 128-bit XMM register (OpInfo) on stack (RSP/FP + next slot).
797 * YASM: [savexmm128 reg, offset]
798 * MASM: .SAVEXMM128 reg, offset */
799 IMAGE_AMD64_UWOP_SAVE_XMM128,
800 /** Save 128-bit XMM register (OpInfo) on stack (RSP/FP + next two slots).
801 * YASM: [savexmm128 reg, offset]
802 * MASM: .SAVEXMM128 reg, offset */
803 IMAGE_AMD64_UWOP_SAVE_XMM128_FAR,
804 /** IRET frame, OpInfo serves as error code indicator.
805 * YASM: [pushframe with-code]
806 * MASM: .pushframe with-code */
807 IMAGE_AMD64_UWOP_PUSH_MACHFRAME
808} IMAGE_AMD64_UNWIND_OP_CODES;
809/** @} */
810
811
812
813/** @name Image load config directories
814 * @{ */
815
816/** @since Windows 10 (preview 9879) */
817typedef struct _IMAGE_LOAD_CONFIG_CODE_INTEGRITY
818{
819 uint16_t Flags;
820 uint16_t Catalog;
821 uint32_t CatalogOffset;
822 uint32_t Reserved;
823} IMAGE_LOAD_CONFIG_CODE_INTEGRITY;
824AssertCompileSize(IMAGE_LOAD_CONFIG_CODE_INTEGRITY, 12);
825typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY *PIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
826typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY const *PCIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
827
828typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V1
829{
830 uint32_t Size;
831 uint32_t TimeDateStamp;
832 uint16_t MajorVersion;
833 uint16_t MinorVersion;
834 uint32_t GlobalFlagsClear;
835 uint32_t GlobalFlagsSet;
836 uint32_t CriticalSectionDefaultTimeout;
837 uint32_t DeCommitFreeBlockThreshold;
838 uint32_t DeCommitTotalFreeThreshold;
839 uint32_t LockPrefixTable;
840 uint32_t MaximumAllocationSize;
841 uint32_t VirtualMemoryThreshold;
842 uint32_t ProcessHeapFlags;
843 uint32_t ProcessAffinityMask;
844 uint16_t CSDVersion;
845 uint16_t DependentLoadFlags;
846 uint32_t EditList;
847 uint32_t SecurityCookie;
848} IMAGE_LOAD_CONFIG_DIRECTORY32_V1;
849AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V1, 0x40);
850typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
851typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
852
853typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V2
854{
855 uint32_t Size;
856 uint32_t TimeDateStamp;
857 uint16_t MajorVersion;
858 uint16_t MinorVersion;
859 uint32_t GlobalFlagsClear;
860 uint32_t GlobalFlagsSet;
861 uint32_t CriticalSectionDefaultTimeout;
862 uint32_t DeCommitFreeBlockThreshold;
863 uint32_t DeCommitTotalFreeThreshold;
864 uint32_t LockPrefixTable;
865 uint32_t MaximumAllocationSize;
866 uint32_t VirtualMemoryThreshold;
867 uint32_t ProcessHeapFlags;
868 uint32_t ProcessAffinityMask;
869 uint16_t CSDVersion;
870 uint16_t DependentLoadFlags;
871 uint32_t EditList;
872 uint32_t SecurityCookie;
873 uint32_t SEHandlerTable;
874 uint32_t SEHandlerCount;
875} IMAGE_LOAD_CONFIG_DIRECTORY32_V2;
876AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V2, 0x48);
877typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
878typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
879
880typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V3
881{
882 uint32_t Size;
883 uint32_t TimeDateStamp;
884 uint16_t MajorVersion;
885 uint16_t MinorVersion;
886 uint32_t GlobalFlagsClear;
887 uint32_t GlobalFlagsSet;
888 uint32_t CriticalSectionDefaultTimeout;
889 uint32_t DeCommitFreeBlockThreshold;
890 uint32_t DeCommitTotalFreeThreshold;
891 uint32_t LockPrefixTable;
892 uint32_t MaximumAllocationSize;
893 uint32_t VirtualMemoryThreshold;
894 uint32_t ProcessHeapFlags;
895 uint32_t ProcessAffinityMask;
896 uint16_t CSDVersion;
897 uint16_t DependentLoadFlags;
898 uint32_t EditList;
899 uint32_t SecurityCookie;
900 uint32_t SEHandlerTable;
901 uint32_t SEHandlerCount;
902 uint32_t GuardCFCCheckFunctionPointer;
903 uint32_t GuardCFDispatchFunctionPointer;
904 uint32_t GuardCFFunctionTable;
905 uint32_t GuardCFFunctionCount;
906 uint32_t GuardFlags;
907} IMAGE_LOAD_CONFIG_DIRECTORY32_V3;
908AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V3, 0x5c);
909typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
910typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
911
912/** @since Windows 10 (preview 9879) */
913typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V4
914{
915 uint32_t Size;
916 uint32_t TimeDateStamp;
917 uint16_t MajorVersion;
918 uint16_t MinorVersion;
919 uint32_t GlobalFlagsClear;
920 uint32_t GlobalFlagsSet;
921 uint32_t CriticalSectionDefaultTimeout;
922 uint32_t DeCommitFreeBlockThreshold;
923 uint32_t DeCommitTotalFreeThreshold;
924 uint32_t LockPrefixTable;
925 uint32_t MaximumAllocationSize;
926 uint32_t VirtualMemoryThreshold;
927 uint32_t ProcessHeapFlags;
928 uint32_t ProcessAffinityMask;
929 uint16_t CSDVersion;
930 uint16_t DependentLoadFlags;
931 uint32_t EditList;
932 uint32_t SecurityCookie;
933 uint32_t SEHandlerTable;
934 uint32_t SEHandlerCount;
935 uint32_t GuardCFCCheckFunctionPointer;
936 uint32_t GuardCFDispatchFunctionPointer;
937 uint32_t GuardCFFunctionTable;
938 uint32_t GuardCFFunctionCount;
939 uint32_t GuardFlags;
940 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
941} IMAGE_LOAD_CONFIG_DIRECTORY32_V4;
942AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V4, 0x68);
943typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
944typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
945
946/** @since Windows 10 build 14286 (or maybe earlier). */
947typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V5
948{
949 uint32_t Size;
950 uint32_t TimeDateStamp;
951 uint16_t MajorVersion;
952 uint16_t MinorVersion;
953 uint32_t GlobalFlagsClear;
954 uint32_t GlobalFlagsSet;
955 uint32_t CriticalSectionDefaultTimeout;
956 uint32_t DeCommitFreeBlockThreshold;
957 uint32_t DeCommitTotalFreeThreshold;
958 uint32_t LockPrefixTable;
959 uint32_t MaximumAllocationSize;
960 uint32_t VirtualMemoryThreshold;
961 uint32_t ProcessHeapFlags;
962 uint32_t ProcessAffinityMask;
963 uint16_t CSDVersion;
964 uint16_t DependentLoadFlags;
965 uint32_t EditList;
966 uint32_t SecurityCookie;
967 uint32_t SEHandlerTable;
968 uint32_t SEHandlerCount;
969 uint32_t GuardCFCCheckFunctionPointer;
970 uint32_t GuardCFDispatchFunctionPointer;
971 uint32_t GuardCFFunctionTable;
972 uint32_t GuardCFFunctionCount;
973 uint32_t GuardFlags;
974 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
975 uint32_t GuardAddressTakenIatEntryTable;
976 uint32_t GuardAddressTakenIatEntryCount;
977 uint32_t GuardLongJumpTargetTable;
978 uint32_t GuardLongJumpTargetCount;
979} IMAGE_LOAD_CONFIG_DIRECTORY32_V5;
980AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V5, 0x78);
981typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V5 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V5;
982typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V5 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V5;
983
984/** @since Windows 10 build 14383 (or maybe earlier). */
985typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V6
986{
987 uint32_t Size; /**< 0x00 */
988 uint32_t TimeDateStamp; /**< 0x04 */
989 uint16_t MajorVersion; /**< 0x08 */
990 uint16_t MinorVersion; /**< 0x0a */
991 uint32_t GlobalFlagsClear; /**< 0x0c */
992 uint32_t GlobalFlagsSet; /**< 0x10 */
993 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
994 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
995 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
996 uint32_t LockPrefixTable; /**< 0x20 */
997 uint32_t MaximumAllocationSize; /**< 0x24 */
998 uint32_t VirtualMemoryThreshold; /**< 0x28 */
999 uint32_t ProcessHeapFlags; /**< 0x2c */
1000 uint32_t ProcessAffinityMask; /**< 0x30 */
1001 uint16_t CSDVersion; /**< 0x34 */
1002 uint16_t DependentLoadFlags; /**< 0x36 */
1003 uint32_t EditList; /**< 0x38 */
1004 uint32_t SecurityCookie; /**< 0x3c */
1005 uint32_t SEHandlerTable; /**< 0x40 */
1006 uint32_t SEHandlerCount; /**< 0x44 */
1007 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1008 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1009 uint32_t GuardCFFunctionTable; /**< 0x50 */
1010 uint32_t GuardCFFunctionCount; /**< 0x54 */
1011 uint32_t GuardFlags; /**< 0x58 */
1012 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1013 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1014 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1015 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1016 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1017 uint32_t DynamicValueRelocTable; /**< 0x78 */
1018 uint32_t HybridMetadataPointer; /**< 0x7c */
1019} IMAGE_LOAD_CONFIG_DIRECTORY32_V6;
1020AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V6, 0x80);
1021typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V6 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V6;
1022typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V6 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V6;
1023
1024/** @since Windows 10 build 14901 (or maybe earlier). */
1025typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V7
1026{
1027 uint32_t Size; /**< 0x00 */
1028 uint32_t TimeDateStamp; /**< 0x04 */
1029 uint16_t MajorVersion; /**< 0x08 */
1030 uint16_t MinorVersion; /**< 0x0a */
1031 uint32_t GlobalFlagsClear; /**< 0x0c */
1032 uint32_t GlobalFlagsSet; /**< 0x10 */
1033 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1034 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1035 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1036 uint32_t LockPrefixTable; /**< 0x20 */
1037 uint32_t MaximumAllocationSize; /**< 0x24 */
1038 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1039 uint32_t ProcessHeapFlags; /**< 0x2c */
1040 uint32_t ProcessAffinityMask; /**< 0x30 */
1041 uint16_t CSDVersion; /**< 0x34 */
1042 uint16_t DependentLoadFlags; /**< 0x36 */
1043 uint32_t EditList; /**< 0x38 */
1044 uint32_t SecurityCookie; /**< 0x3c */
1045 uint32_t SEHandlerTable; /**< 0x40 */
1046 uint32_t SEHandlerCount; /**< 0x44 */
1047 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1048 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1049 uint32_t GuardCFFunctionTable; /**< 0x50 */
1050 uint32_t GuardCFFunctionCount; /**< 0x54 */
1051 uint32_t GuardFlags; /**< 0x58 */
1052 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1053 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1054 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1055 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1056 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1057 uint32_t DynamicValueRelocTable; /**< 0x78 */
1058 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1059 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1060 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1061 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1062 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1063 uint16_t Reserved2; /**< 0x8e */
1064} IMAGE_LOAD_CONFIG_DIRECTORY32_V7;
1065AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V7, 0x90);
1066typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V7 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V7;
1067typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V7 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V7;
1068
1069/** @since Windows 10 build 15002 (or maybe earlier). */
1070typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V8
1071{
1072 uint32_t Size; /**< 0x00 */
1073 uint32_t TimeDateStamp; /**< 0x04 */
1074 uint16_t MajorVersion; /**< 0x08 */
1075 uint16_t MinorVersion; /**< 0x0a */
1076 uint32_t GlobalFlagsClear; /**< 0x0c */
1077 uint32_t GlobalFlagsSet; /**< 0x10 */
1078 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1079 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1080 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1081 uint32_t LockPrefixTable; /**< 0x20 */
1082 uint32_t MaximumAllocationSize; /**< 0x24 */
1083 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1084 uint32_t ProcessHeapFlags; /**< 0x2c */
1085 uint32_t ProcessAffinityMask; /**< 0x30 */
1086 uint16_t CSDVersion; /**< 0x34 */
1087 uint16_t DependentLoadFlags; /**< 0x36 */
1088 uint32_t EditList; /**< 0x38 */
1089 uint32_t SecurityCookie; /**< 0x3c */
1090 uint32_t SEHandlerTable; /**< 0x40 */
1091 uint32_t SEHandlerCount; /**< 0x44 */
1092 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1093 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1094 uint32_t GuardCFFunctionTable; /**< 0x50 */
1095 uint32_t GuardCFFunctionCount; /**< 0x54 */
1096 uint32_t GuardFlags; /**< 0x58 */
1097 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1098 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1099 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1100 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1101 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1102 uint32_t DynamicValueRelocTable; /**< 0x78 */
1103 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1104 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1105 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1106 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1107 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1108 uint16_t Reserved2; /**< 0x8e */
1109 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1110 uint32_t HotPatchTableOffset; /**< 0x94 */
1111} IMAGE_LOAD_CONFIG_DIRECTORY32_V8;
1112AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V8, 0x98);
1113typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V8 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V8;
1114typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V8 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V8;
1115
1116/** @since Windows 10 build 16237 (or maybe earlier). */
1117typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V9
1118{
1119 uint32_t Size; /**< 0x00 */
1120 uint32_t TimeDateStamp; /**< 0x04 */
1121 uint16_t MajorVersion; /**< 0x08 */
1122 uint16_t MinorVersion; /**< 0x0a */
1123 uint32_t GlobalFlagsClear; /**< 0x0c */
1124 uint32_t GlobalFlagsSet; /**< 0x10 */
1125 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1126 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1127 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1128 uint32_t LockPrefixTable; /**< 0x20 */
1129 uint32_t MaximumAllocationSize; /**< 0x24 */
1130 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1131 uint32_t ProcessHeapFlags; /**< 0x2c */
1132 uint32_t ProcessAffinityMask; /**< 0x30 */
1133 uint16_t CSDVersion; /**< 0x34 */
1134 uint16_t DependentLoadFlags; /**< 0x36 */
1135 uint32_t EditList; /**< 0x38 */
1136 uint32_t SecurityCookie; /**< 0x3c */
1137 uint32_t SEHandlerTable; /**< 0x40 */
1138 uint32_t SEHandlerCount; /**< 0x44 */
1139 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1140 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1141 uint32_t GuardCFFunctionTable; /**< 0x50 */
1142 uint32_t GuardCFFunctionCount; /**< 0x54 */
1143 uint32_t GuardFlags; /**< 0x58 */
1144 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1145 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1146 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1147 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1148 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1149 uint32_t DynamicValueRelocTable; /**< 0x78 */
1150 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1151 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1152 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1153 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1154 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1155 uint16_t Reserved2; /**< 0x8e */
1156 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1157 uint32_t HotPatchTableOffset; /**< 0x94 */
1158 uint32_t Reserved3; /**< 0x98 */
1159 uint32_t EnclaveConfigurationPointer; /**< 0x9c */
1160} IMAGE_LOAD_CONFIG_DIRECTORY32_V9;
1161AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V9, 0xa0);
1162typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V9 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V9;
1163typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V9 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V9;
1164
1165/** @since Windows 10 build 18362 (or maybe earlier). */
1166typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V10
1167{
1168 uint32_t Size; /**< 0x00 */
1169 uint32_t TimeDateStamp; /**< 0x04 */
1170 uint16_t MajorVersion; /**< 0x08 */
1171 uint16_t MinorVersion; /**< 0x0a */
1172 uint32_t GlobalFlagsClear; /**< 0x0c */
1173 uint32_t GlobalFlagsSet; /**< 0x10 */
1174 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1175 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1176 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1177 uint32_t LockPrefixTable; /**< 0x20 */
1178 uint32_t MaximumAllocationSize; /**< 0x24 */
1179 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1180 uint32_t ProcessHeapFlags; /**< 0x2c */
1181 uint32_t ProcessAffinityMask; /**< 0x30 */
1182 uint16_t CSDVersion; /**< 0x34 */
1183 uint16_t DependentLoadFlags; /**< 0x36 */
1184 uint32_t EditList; /**< 0x38 */
1185 uint32_t SecurityCookie; /**< 0x3c */
1186 uint32_t SEHandlerTable; /**< 0x40 */
1187 uint32_t SEHandlerCount; /**< 0x44 */
1188 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1189 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1190 uint32_t GuardCFFunctionTable; /**< 0x50 */
1191 uint32_t GuardCFFunctionCount; /**< 0x54 */
1192 uint32_t GuardFlags; /**< 0x58 */
1193 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1194 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1195 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1196 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1197 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1198 uint32_t DynamicValueRelocTable; /**< 0x78 */
1199 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1200 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1201 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1202 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1203 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1204 uint16_t Reserved2; /**< 0x8e */
1205 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1206 uint32_t HotPatchTableOffset; /**< 0x94 */
1207 uint32_t Reserved3; /**< 0x98 */
1208 uint32_t EnclaveConfigurationPointer; /**< 0x9c */
1209 uint32_t VolatileMetadataPointer; /**< 0xa0 */
1210} IMAGE_LOAD_CONFIG_DIRECTORY32_V10;
1211AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V10, 0xa4);
1212typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V10 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V10;
1213typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V10 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V10;
1214
1215/** @since Windows 10 build 19564 (or maybe earlier). */
1216typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V11
1217{
1218 uint32_t Size; /**< 0x00 */
1219 uint32_t TimeDateStamp; /**< 0x04 */
1220 uint16_t MajorVersion; /**< 0x08 */
1221 uint16_t MinorVersion; /**< 0x0a */
1222 uint32_t GlobalFlagsClear; /**< 0x0c */
1223 uint32_t GlobalFlagsSet; /**< 0x10 */
1224 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1225 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1226 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1227 uint32_t LockPrefixTable; /**< 0x20 */
1228 uint32_t MaximumAllocationSize; /**< 0x24 */
1229 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1230 uint32_t ProcessHeapFlags; /**< 0x2c */
1231 uint32_t ProcessAffinityMask; /**< 0x30 */
1232 uint16_t CSDVersion; /**< 0x34 */
1233 uint16_t DependentLoadFlags; /**< 0x36 */
1234 uint32_t EditList; /**< 0x38 */
1235 uint32_t SecurityCookie; /**< 0x3c */
1236 uint32_t SEHandlerTable; /**< 0x40 */
1237 uint32_t SEHandlerCount; /**< 0x44 */
1238 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1239 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1240 uint32_t GuardCFFunctionTable; /**< 0x50 */
1241 uint32_t GuardCFFunctionCount; /**< 0x54 */
1242 uint32_t GuardFlags; /**< 0x58 */
1243 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1244 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1245 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1246 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1247 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1248 uint32_t DynamicValueRelocTable; /**< 0x78 */
1249 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1250 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1251 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1252 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1253 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1254 uint16_t Reserved2; /**< 0x8e */
1255 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1256 uint32_t HotPatchTableOffset; /**< 0x94 */
1257 uint32_t Reserved3; /**< 0x98 */
1258 uint32_t EnclaveConfigurationPointer; /**< 0x9c - virtual address */
1259 uint32_t VolatileMetadataPointer; /**< 0xa0 */
1260 uint32_t GuardEHContinuationTable; /**< 0xa4 - virtual address */
1261 uint32_t GuardEHContinuationCount; /**< 0xa8 */
1262} IMAGE_LOAD_CONFIG_DIRECTORY32_V11;
1263AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V11, 0xac);
1264typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V11 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V11;
1265typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V11 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V11;
1266
1267/** @since Visual C++ 2019 / RS5_IMAGE_LOAD_CONFIG_DIRECTORY32. */
1268typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V12
1269{
1270 uint32_t Size; /**< 0x00 */
1271 uint32_t TimeDateStamp; /**< 0x04 */
1272 uint16_t MajorVersion; /**< 0x08 */
1273 uint16_t MinorVersion; /**< 0x0a */
1274 uint32_t GlobalFlagsClear; /**< 0x0c */
1275 uint32_t GlobalFlagsSet; /**< 0x10 */
1276 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1277 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1278 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1279 uint32_t LockPrefixTable; /**< 0x20 */
1280 uint32_t MaximumAllocationSize; /**< 0x24 */
1281 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1282 uint32_t ProcessHeapFlags; /**< 0x2c */
1283 uint32_t ProcessAffinityMask; /**< 0x30 */
1284 uint16_t CSDVersion; /**< 0x34 */
1285 uint16_t DependentLoadFlags; /**< 0x36 */
1286 uint32_t EditList; /**< 0x38 */
1287 uint32_t SecurityCookie; /**< 0x3c */
1288 uint32_t SEHandlerTable; /**< 0x40 */
1289 uint32_t SEHandlerCount; /**< 0x44 */
1290 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1291 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1292 uint32_t GuardCFFunctionTable; /**< 0x50 */
1293 uint32_t GuardCFFunctionCount; /**< 0x54 */
1294 uint32_t GuardFlags; /**< 0x58 */
1295 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1296 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1297 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1298 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1299 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1300 uint32_t DynamicValueRelocTable; /**< 0x78 */
1301 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1302 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1303 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1304 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1305 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1306 uint16_t Reserved2; /**< 0x8e */
1307 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1308 uint32_t HotPatchTableOffset; /**< 0x94 */
1309 uint32_t Reserved3; /**< 0x98 */
1310 uint32_t EnclaveConfigurationPointer; /**< 0x9c - virtual address */
1311 uint32_t VolatileMetadataPointer; /**< 0xa0 */
1312 uint32_t GuardEHContinuationTable; /**< 0xa4 - virtual address */
1313 uint32_t GuardEHContinuationCount; /**< 0xa8 */
1314 uint32_t GuardXFGCheckFunctionPointer; /**< 0xac */
1315 uint32_t GuardXFGDispatchFunctionPointer; /**< 0xb0 */
1316 uint32_t GuardXFGTableDispatchFunctionPointer; /**< 0xb4 */
1317} IMAGE_LOAD_CONFIG_DIRECTORY32_V12;
1318AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V12, 0xb8);
1319typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V12 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V12;
1320typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V12 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V12;
1321
1322/** @since Visual C++ 2019 16.x (found in 16.11.9) / RS5_IMAGE_LOAD_CONFIG_DIRECTORY32. */
1323typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V13
1324{
1325 uint32_t Size; /**< 0x00 - virtual address */
1326 uint32_t TimeDateStamp; /**< 0x04 */
1327 uint16_t MajorVersion; /**< 0x08 */
1328 uint16_t MinorVersion; /**< 0x0a */
1329 uint32_t GlobalFlagsClear; /**< 0x0c */
1330 uint32_t GlobalFlagsSet; /**< 0x10 */
1331 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1332 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 - virtual address */
1333 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c - virtual address */
1334 uint32_t LockPrefixTable; /**< 0x20 */
1335 uint32_t MaximumAllocationSize; /**< 0x24 */
1336 uint32_t VirtualMemoryThreshold; /**< 0x28 - virtual address of pointer variable */
1337 uint32_t ProcessHeapFlags; /**< 0x2c - virtual address of pointer variable */
1338 uint32_t ProcessAffinityMask; /**< 0x30 - virtual address */
1339 uint16_t CSDVersion; /**< 0x34 */
1340 uint16_t DependentLoadFlags; /**< 0x36 */
1341 uint32_t EditList; /**< 0x38 */
1342 uint32_t SecurityCookie; /**< 0x3c - virtual address */
1343 uint32_t SEHandlerTable; /**< 0x40 */
1344 uint32_t SEHandlerCount; /**< 0x44 - virtual address */
1345 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1346 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c - virtual address */
1347 uint32_t GuardCFFunctionTable; /**< 0x50 */
1348 uint32_t GuardCFFunctionCount; /**< 0x54 - virtual address */
1349 uint32_t GuardFlags; /**< 0x58 - virtual address of pointer variable */
1350 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1351 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 - virtual address */
1352 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1353 uint32_t GuardLongJumpTargetTable; /**< 0x70 - virtual address */
1354 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1355 uint32_t DynamicValueRelocTable; /**< 0x78 - virtual address */
1356 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1357 uint32_t GuardRFFailureRoutine; /**< 0x80 - virtual address */
1358 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 - virtual address of pointer variable */
1359 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1360 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1361 uint16_t Reserved2; /**< 0x8e */
1362 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 - virtual address of pointer variable */
1363 uint32_t HotPatchTableOffset; /**< 0x94 */
1364 uint32_t Reserved3; /**< 0x98 */
1365 uint32_t EnclaveConfigurationPointer; /**< 0x9c - virtual address of pointer variable */
1366 uint32_t VolatileMetadataPointer; /**< 0xa0 - virtual address of pointer variable */
1367 uint32_t GuardEHContinuationTable; /**< 0xa4 - virtual address */
1368 uint32_t GuardEHContinuationCount; /**< 0xa8 */
1369 uint32_t GuardXFGCheckFunctionPointer; /**< 0xac - virtual address of pointer variable */
1370 uint32_t GuardXFGDispatchFunctionPointer; /**< 0xb0 - virtual address of pointer variable */
1371 uint32_t GuardXFGTableDispatchFunctionPointer; /**< 0xb4 - virtual address of pointer variable */
1372 uint32_t CastGuardOsDeterminedFailureMode; /**< 0xb8 - virtual address */
1373} IMAGE_LOAD_CONFIG_DIRECTORY32_V13;
1374AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V13, 0xbc);
1375typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V13 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V13;
1376typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V13 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V13;
1377
1378typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V13 IMAGE_LOAD_CONFIG_DIRECTORY32;
1379typedef PIMAGE_LOAD_CONFIG_DIRECTORY32_V13 PIMAGE_LOAD_CONFIG_DIRECTORY32;
1380typedef PCIMAGE_LOAD_CONFIG_DIRECTORY32_V13 PCIMAGE_LOAD_CONFIG_DIRECTORY32;
1381
1382
1383/* No _IMAGE_LOAD_CONFIG_DIRECTORY64_V1 exists. */
1384
1385typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V2
1386{
1387 uint32_t Size;
1388 uint32_t TimeDateStamp;
1389 uint16_t MajorVersion;
1390 uint16_t MinorVersion;
1391 uint32_t GlobalFlagsClear;
1392 uint32_t GlobalFlagsSet;
1393 uint32_t CriticalSectionDefaultTimeout;
1394 uint64_t DeCommitFreeBlockThreshold;
1395 uint64_t DeCommitTotalFreeThreshold;
1396 uint64_t LockPrefixTable;
1397 uint64_t MaximumAllocationSize;
1398 uint64_t VirtualMemoryThreshold;
1399 uint64_t ProcessAffinityMask;
1400 uint32_t ProcessHeapFlags;
1401 uint16_t CSDVersion;
1402 uint16_t DependentLoadFlags;
1403 uint64_t EditList;
1404 uint64_t SecurityCookie;
1405 uint64_t SEHandlerTable;
1406 uint64_t SEHandlerCount;
1407} IMAGE_LOAD_CONFIG_DIRECTORY64_V2;
1408AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V2, 0x70);
1409typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
1410typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
1411
1412#pragma pack(4) /* Why not 8 byte alignment, baka microsofties?!? */
1413typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V3
1414{
1415 uint32_t Size;
1416 uint32_t TimeDateStamp;
1417 uint16_t MajorVersion;
1418 uint16_t MinorVersion;
1419 uint32_t GlobalFlagsClear;
1420 uint32_t GlobalFlagsSet;
1421 uint32_t CriticalSectionDefaultTimeout;
1422 uint64_t DeCommitFreeBlockThreshold;
1423 uint64_t DeCommitTotalFreeThreshold;
1424 uint64_t LockPrefixTable;
1425 uint64_t MaximumAllocationSize;
1426 uint64_t VirtualMemoryThreshold;
1427 uint64_t ProcessAffinityMask;
1428 uint32_t ProcessHeapFlags;
1429 uint16_t CSDVersion;
1430 uint16_t DependentLoadFlags;
1431 uint64_t EditList;
1432 uint64_t SecurityCookie;
1433 uint64_t SEHandlerTable;
1434 uint64_t SEHandlerCount;
1435 uint64_t GuardCFCCheckFunctionPointer;
1436 uint64_t GuardCFDispatchFunctionPointer;
1437 uint64_t GuardCFFunctionTable;
1438 uint64_t GuardCFFunctionCount;
1439 uint32_t GuardFlags;
1440} IMAGE_LOAD_CONFIG_DIRECTORY64_V3;
1441#pragma pack()
1442AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V3, 0x94);
1443typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
1444typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
1445
1446/** @since Windows 10 (Preview (9879). */
1447typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V4
1448{
1449 uint32_t Size; /**< 0x00 */
1450 uint32_t TimeDateStamp; /**< 0x04 */
1451 uint16_t MajorVersion; /**< 0x08 */
1452 uint16_t MinorVersion; /**< 0x0a */
1453 uint32_t GlobalFlagsClear; /**< 0x0c */
1454 uint32_t GlobalFlagsSet; /**< 0x10 */
1455 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1456 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1457 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1458 uint64_t LockPrefixTable; /**< 0x28 */
1459 uint64_t MaximumAllocationSize; /**< 0x30 */
1460 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1461 uint64_t ProcessAffinityMask; /**< 0x40 */
1462 uint32_t ProcessHeapFlags; /**< 0x48 */
1463 uint16_t CSDVersion; /**< 0x4c */
1464 uint16_t DependentLoadFlags; /**< 0x4e */
1465 uint64_t EditList; /**< 0x50 */
1466 uint64_t SecurityCookie; /**< 0x58 */
1467 uint64_t SEHandlerTable; /**< 0x60 */
1468 uint64_t SEHandlerCount; /**< 0x68 */
1469 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1470 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1471 uint64_t GuardCFFunctionTable; /**< 0x80 */
1472 uint64_t GuardCFFunctionCount; /**< 0x88 */
1473 uint32_t GuardFlags; /**< 0x90 */
1474 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1475} IMAGE_LOAD_CONFIG_DIRECTORY64_V4;
1476AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V4, 0xa0);
1477typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
1478typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
1479
1480/** @since Windows 10 build 14286 (or maybe earlier). */
1481typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V5
1482{
1483 uint32_t Size; /**< 0x00 */
1484 uint32_t TimeDateStamp; /**< 0x04 */
1485 uint16_t MajorVersion; /**< 0x08 */
1486 uint16_t MinorVersion; /**< 0x0a */
1487 uint32_t GlobalFlagsClear; /**< 0x0c */
1488 uint32_t GlobalFlagsSet; /**< 0x10 */
1489 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1490 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1491 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1492 uint64_t LockPrefixTable; /**< 0x28 */
1493 uint64_t MaximumAllocationSize; /**< 0x30 */
1494 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1495 uint64_t ProcessAffinityMask; /**< 0x40 */
1496 uint32_t ProcessHeapFlags; /**< 0x48 */
1497 uint16_t CSDVersion; /**< 0x4c */
1498 uint16_t DependentLoadFlags; /**< 0x4e */
1499 uint64_t EditList; /**< 0x50 */
1500 uint64_t SecurityCookie; /**< 0x58 */
1501 uint64_t SEHandlerTable; /**< 0x60 */
1502 uint64_t SEHandlerCount; /**< 0x68 */
1503 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1504 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1505 uint64_t GuardCFFunctionTable; /**< 0x80 */
1506 uint64_t GuardCFFunctionCount; /**< 0x88 */
1507 uint32_t GuardFlags; /**< 0x90 */
1508 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1509 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1510 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1511 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1512 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1513} IMAGE_LOAD_CONFIG_DIRECTORY64_V5;
1514AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V5, 0xc0);
1515typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V5 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V5;
1516typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V5 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V5;
1517
1518/** @since Windows 10 build 14393 (or maybe earlier). */
1519typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V6
1520{
1521 uint32_t Size; /**< 0x00 */
1522 uint32_t TimeDateStamp; /**< 0x04 */
1523 uint16_t MajorVersion; /**< 0x08 */
1524 uint16_t MinorVersion; /**< 0x0a */
1525 uint32_t GlobalFlagsClear; /**< 0x0c */
1526 uint32_t GlobalFlagsSet; /**< 0x10 */
1527 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1528 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1529 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1530 uint64_t LockPrefixTable; /**< 0x28 */
1531 uint64_t MaximumAllocationSize; /**< 0x30 */
1532 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1533 uint64_t ProcessAffinityMask; /**< 0x40 */
1534 uint32_t ProcessHeapFlags; /**< 0x48 */
1535 uint16_t CSDVersion; /**< 0x4c */
1536 uint16_t DependentLoadFlags; /**< 0x4e */
1537 uint64_t EditList; /**< 0x50 */
1538 uint64_t SecurityCookie; /**< 0x58 */
1539 uint64_t SEHandlerTable; /**< 0x60 */
1540 uint64_t SEHandlerCount; /**< 0x68 */
1541 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1542 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1543 uint64_t GuardCFFunctionTable; /**< 0x80 */
1544 uint64_t GuardCFFunctionCount; /**< 0x88 */
1545 uint32_t GuardFlags; /**< 0x90 */
1546 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1547 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1548 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1549 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1550 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1551 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1552 uint64_t HybridMetadataPointer; /**< 0xc8 */
1553} IMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1554AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V6, 0xd0);
1555typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V6 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1556typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V6 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1557
1558/** @since Windows 10 build 14901 (or maybe earlier). */
1559typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V7
1560{
1561 uint32_t Size; /**< 0x00 */
1562 uint32_t TimeDateStamp; /**< 0x04 */
1563 uint16_t MajorVersion; /**< 0x08 */
1564 uint16_t MinorVersion; /**< 0x0a */
1565 uint32_t GlobalFlagsClear; /**< 0x0c */
1566 uint32_t GlobalFlagsSet; /**< 0x10 */
1567 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1568 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1569 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1570 uint64_t LockPrefixTable; /**< 0x28 */
1571 uint64_t MaximumAllocationSize; /**< 0x30 */
1572 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1573 uint64_t ProcessAffinityMask; /**< 0x40 */
1574 uint32_t ProcessHeapFlags; /**< 0x48 */
1575 uint16_t CSDVersion; /**< 0x4c */
1576 uint16_t DependentLoadFlags; /**< 0x4e */
1577 uint64_t EditList; /**< 0x50 */
1578 uint64_t SecurityCookie; /**< 0x58 */
1579 uint64_t SEHandlerTable; /**< 0x60 */
1580 uint64_t SEHandlerCount; /**< 0x68 */
1581 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1582 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1583 uint64_t GuardCFFunctionTable; /**< 0x80 */
1584 uint64_t GuardCFFunctionCount; /**< 0x88 */
1585 uint32_t GuardFlags; /**< 0x90 */
1586 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1587 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1588 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1589 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1590 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1591 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1592 uint64_t CHPEMetadataPointer; /**< 0xc8 Not sure when this was renamed from HybridMetadataPointer. */
1593 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1594 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1595 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1596 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1597 uint16_t Reserved2; /**< 0xe6 */
1598} IMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1599AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V7, 0xe8);
1600typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V7 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1601typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V7 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1602
1603/** @since Windows 10 build 15002 (or maybe earlier). */
1604#pragma pack(4) /* Stupid, stupid microsofties! */
1605typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V8
1606{
1607 uint32_t Size; /**< 0x00 */
1608 uint32_t TimeDateStamp; /**< 0x04 */
1609 uint16_t MajorVersion; /**< 0x08 */
1610 uint16_t MinorVersion; /**< 0x0a */
1611 uint32_t GlobalFlagsClear; /**< 0x0c */
1612 uint32_t GlobalFlagsSet; /**< 0x10 */
1613 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1614 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1615 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1616 uint64_t LockPrefixTable; /**< 0x28 */
1617 uint64_t MaximumAllocationSize; /**< 0x30 */
1618 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1619 uint64_t ProcessAffinityMask; /**< 0x40 */
1620 uint32_t ProcessHeapFlags; /**< 0x48 */
1621 uint16_t CSDVersion; /**< 0x4c */
1622 uint16_t DependentLoadFlags; /**< 0x4e */
1623 uint64_t EditList; /**< 0x50 */
1624 uint64_t SecurityCookie; /**< 0x58 */
1625 uint64_t SEHandlerTable; /**< 0x60 */
1626 uint64_t SEHandlerCount; /**< 0x68 */
1627 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1628 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1629 uint64_t GuardCFFunctionTable; /**< 0x80 */
1630 uint64_t GuardCFFunctionCount; /**< 0x88 */
1631 uint32_t GuardFlags; /**< 0x90 */
1632 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1633 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1634 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1635 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1636 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1637 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1638 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1639 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1640 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1641 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1642 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1643 uint16_t Reserved2; /**< 0xe6 */
1644 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1645 uint32_t HotPatchTableOffset; /**< 0xf0 */
1646} IMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1647#pragma pack()
1648AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V8, 0xf4);
1649typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V8 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1650typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V8 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1651
1652/** @since Windows 10 build 15002 (or maybe earlier). */
1653typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V9
1654{
1655 uint32_t Size; /**< 0x00 */
1656 uint32_t TimeDateStamp; /**< 0x04 */
1657 uint16_t MajorVersion; /**< 0x08 */
1658 uint16_t MinorVersion; /**< 0x0a */
1659 uint32_t GlobalFlagsClear; /**< 0x0c */
1660 uint32_t GlobalFlagsSet; /**< 0x10 */
1661 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1662 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1663 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1664 uint64_t LockPrefixTable; /**< 0x28 */
1665 uint64_t MaximumAllocationSize; /**< 0x30 */
1666 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1667 uint64_t ProcessAffinityMask; /**< 0x40 */
1668 uint32_t ProcessHeapFlags; /**< 0x48 */
1669 uint16_t CSDVersion; /**< 0x4c */
1670 uint16_t DependentLoadFlags; /**< 0x4e */
1671 uint64_t EditList; /**< 0x50 */
1672 uint64_t SecurityCookie; /**< 0x58 */
1673 uint64_t SEHandlerTable; /**< 0x60 */
1674 uint64_t SEHandlerCount; /**< 0x68 */
1675 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1676 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1677 uint64_t GuardCFFunctionTable; /**< 0x80 */
1678 uint64_t GuardCFFunctionCount; /**< 0x88 */
1679 uint32_t GuardFlags; /**< 0x90 */
1680 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1681 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1682 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1683 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1684 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1685 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1686 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1687 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1688 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1689 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1690 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1691 uint16_t Reserved2; /**< 0xe6 */
1692 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1693 uint32_t HotPatchTableOffset; /**< 0xf0 */
1694 uint32_t Reserved3; /**< 0xf4 */
1695 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
1696} IMAGE_LOAD_CONFIG_DIRECTORY64_V9;
1697AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V9, 0x100);
1698typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V9 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V9;
1699typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V9 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V9;
1700
1701/** @since Windows 10 build 18362 (or maybe earlier). */
1702typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V10
1703{
1704 uint32_t Size; /**< 0x00 */
1705 uint32_t TimeDateStamp; /**< 0x04 */
1706 uint16_t MajorVersion; /**< 0x08 */
1707 uint16_t MinorVersion; /**< 0x0a */
1708 uint32_t GlobalFlagsClear; /**< 0x0c */
1709 uint32_t GlobalFlagsSet; /**< 0x10 */
1710 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1711 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1712 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1713 uint64_t LockPrefixTable; /**< 0x28 */
1714 uint64_t MaximumAllocationSize; /**< 0x30 */
1715 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1716 uint64_t ProcessAffinityMask; /**< 0x40 */
1717 uint32_t ProcessHeapFlags; /**< 0x48 */
1718 uint16_t CSDVersion; /**< 0x4c */
1719 uint16_t DependentLoadFlags; /**< 0x4e */
1720 uint64_t EditList; /**< 0x50 */
1721 uint64_t SecurityCookie; /**< 0x58 */
1722 uint64_t SEHandlerTable; /**< 0x60 */
1723 uint64_t SEHandlerCount; /**< 0x68 */
1724 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1725 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1726 uint64_t GuardCFFunctionTable; /**< 0x80 */
1727 uint64_t GuardCFFunctionCount; /**< 0x88 */
1728 uint32_t GuardFlags; /**< 0x90 */
1729 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1730 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1731 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1732 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1733 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1734 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1735 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1736 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1737 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1738 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1739 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1740 uint16_t Reserved2; /**< 0xe6 */
1741 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1742 uint32_t HotPatchTableOffset; /**< 0xf0 */
1743 uint32_t Reserved3; /**< 0xf4 */
1744 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
1745 uint64_t VolatileMetadataPointer; /**< 0x100 */
1746} IMAGE_LOAD_CONFIG_DIRECTORY64_V10;
1747AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V10, 0x108);
1748typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V10 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V10;
1749typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V10 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V10;
1750
1751/** @since Windows 10 build 19534 (or maybe earlier). */
1752typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V11
1753{
1754 uint32_t Size; /**< 0x00 */
1755 uint32_t TimeDateStamp; /**< 0x04 */
1756 uint16_t MajorVersion; /**< 0x08 */
1757 uint16_t MinorVersion; /**< 0x0a */
1758 uint32_t GlobalFlagsClear; /**< 0x0c */
1759 uint32_t GlobalFlagsSet; /**< 0x10 */
1760 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1761 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1762 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1763 uint64_t LockPrefixTable; /**< 0x28 */
1764 uint64_t MaximumAllocationSize; /**< 0x30 */
1765 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1766 uint64_t ProcessAffinityMask; /**< 0x40 */
1767 uint32_t ProcessHeapFlags; /**< 0x48 */
1768 uint16_t CSDVersion; /**< 0x4c */
1769 uint16_t DependentLoadFlags; /**< 0x4e */
1770 uint64_t EditList; /**< 0x50 */
1771 uint64_t SecurityCookie; /**< 0x58 */
1772 uint64_t SEHandlerTable; /**< 0x60 */
1773 uint64_t SEHandlerCount; /**< 0x68 */
1774 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1775 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1776 uint64_t GuardCFFunctionTable; /**< 0x80 */
1777 uint64_t GuardCFFunctionCount; /**< 0x88 */
1778 uint32_t GuardFlags; /**< 0x90 */
1779 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1780 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1781 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1782 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1783 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1784 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1785 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1786 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1787 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1788 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1789 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1790 uint16_t Reserved2; /**< 0xe6 */
1791 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1792 uint32_t HotPatchTableOffset; /**< 0xf0 */
1793 uint32_t Reserved3; /**< 0xf4 */
1794 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
1795 uint64_t VolatileMetadataPointer; /**< 0x100 */
1796 uint64_t GuardEHContinuationTable; /**< 0x108 - virtual address */
1797 uint64_t GuardEHContinuationCount; /**< 0x110 */
1798} IMAGE_LOAD_CONFIG_DIRECTORY64_V11;
1799AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V11, 0x118);
1800typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V11 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V11;
1801typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V11 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V11;
1802
1803/** @since Visual C++ 2019 / RS5_IMAGE_LOAD_CONFIG_DIRECTORY64. */
1804typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V12
1805{
1806 uint32_t Size; /**< 0x00 */
1807 uint32_t TimeDateStamp; /**< 0x04 */
1808 uint16_t MajorVersion; /**< 0x08 */
1809 uint16_t MinorVersion; /**< 0x0a */
1810 uint32_t GlobalFlagsClear; /**< 0x0c */
1811 uint32_t GlobalFlagsSet; /**< 0x10 */
1812 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1813 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1814 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1815 uint64_t LockPrefixTable; /**< 0x28 */
1816 uint64_t MaximumAllocationSize; /**< 0x30 */
1817 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1818 uint64_t ProcessAffinityMask; /**< 0x40 */
1819 uint32_t ProcessHeapFlags; /**< 0x48 */
1820 uint16_t CSDVersion; /**< 0x4c */
1821 uint16_t DependentLoadFlags; /**< 0x4e */
1822 uint64_t EditList; /**< 0x50 */
1823 uint64_t SecurityCookie; /**< 0x58 */
1824 uint64_t SEHandlerTable; /**< 0x60 */
1825 uint64_t SEHandlerCount; /**< 0x68 */
1826 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1827 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1828 uint64_t GuardCFFunctionTable; /**< 0x80 */
1829 uint64_t GuardCFFunctionCount; /**< 0x88 */
1830 uint32_t GuardFlags; /**< 0x90 */
1831 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1832 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1833 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1834 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1835 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1836 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1837 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1838 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1839 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1840 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1841 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1842 uint16_t Reserved2; /**< 0xe6 */
1843 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1844 uint32_t HotPatchTableOffset; /**< 0xf0 */
1845 uint32_t Reserved3; /**< 0xf4 */
1846 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
1847 uint64_t VolatileMetadataPointer; /**< 0x100 */
1848 uint64_t GuardEHContinuationTable; /**< 0x108 - virtual address */
1849 uint64_t GuardEHContinuationCount; /**< 0x110 */
1850 uint64_t GuardXFGCheckFunctionPointer; /**< 0x118 */
1851 uint64_t GuardXFGDispatchFunctionPointer; /**< 0x120 */
1852 uint64_t GuardXFGTableDispatchFunctionPointer; /**< 0x128 */
1853} IMAGE_LOAD_CONFIG_DIRECTORY64_V12;
1854AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V12, 0x130);
1855typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V12 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V12;
1856typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V12 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V12;
1857
1858/** @since Visual C++ 2019 16.x (found in 16.11.9) / RS5_IMAGE_LOAD_CONFIG_DIRECTORY32. */
1859typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V13
1860{
1861 uint32_t Size; /**< 0x00 */
1862 uint32_t TimeDateStamp; /**< 0x04 */
1863 uint16_t MajorVersion; /**< 0x08 */
1864 uint16_t MinorVersion; /**< 0x0a */
1865 uint32_t GlobalFlagsClear; /**< 0x0c */
1866 uint32_t GlobalFlagsSet; /**< 0x10 */
1867 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1868 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1869 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1870 uint64_t LockPrefixTable; /**< 0x28 - virtual address */
1871 uint64_t MaximumAllocationSize; /**< 0x30 */
1872 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1873 uint64_t ProcessAffinityMask; /**< 0x40 */
1874 uint32_t ProcessHeapFlags; /**< 0x48 */
1875 uint16_t CSDVersion; /**< 0x4c */
1876 uint16_t DependentLoadFlags; /**< 0x4e */
1877 uint64_t EditList; /**< 0x50 - virtual address */
1878 uint64_t SecurityCookie; /**< 0x58 - virtual address */
1879 uint64_t SEHandlerTable; /**< 0x60 */
1880 uint64_t SEHandlerCount; /**< 0x68 */
1881 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 - virtual address of pointer variable */
1882 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 - virtual address of pointer variable */
1883 uint64_t GuardCFFunctionTable; /**< 0x80 - virtual address */
1884 uint64_t GuardCFFunctionCount; /**< 0x88 */
1885 uint32_t GuardFlags; /**< 0x90 */
1886 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1887 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 - virtual address */
1888 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1889 uint64_t GuardLongJumpTargetTable; /**< 0xb0 - virtual address */
1890 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1891 uint64_t DynamicValueRelocTable; /**< 0xc0 - virtual address */
1892 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1893 uint64_t GuardRFFailureRoutine; /**< 0xd0 - virtual address */
1894 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 - virtual address of pointer variable */
1895 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1896 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1897 uint16_t Reserved2; /**< 0xe6 */
1898 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 - virtual address of pointer variable */
1899 uint32_t HotPatchTableOffset; /**< 0xf0 */
1900 uint32_t Reserved3; /**< 0xf4 */
1901 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
1902 uint64_t VolatileMetadataPointer; /**< 0x100 - virtual address of pointer variable */
1903 uint64_t GuardEHContinuationTable; /**< 0x108 - virtual address */
1904 uint64_t GuardEHContinuationCount; /**< 0x110 */
1905 uint64_t GuardXFGCheckFunctionPointer; /**< 0x118 - virtual address of pointer variable */
1906 uint64_t GuardXFGDispatchFunctionPointer; /**< 0x120 - virtual address of pointer variable */
1907 uint64_t GuardXFGTableDispatchFunctionPointer; /**< 0x128 - virtual address of pointer variable */
1908 uint64_t CastGuardOsDeterminedFailureMode; /**< 0x130 - virtual address */
1909} IMAGE_LOAD_CONFIG_DIRECTORY64_V13;
1910AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V13, 0x138);
1911typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V13 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V13;
1912typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V13 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V13;
1913
1914typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V13 IMAGE_LOAD_CONFIG_DIRECTORY64;
1915typedef PIMAGE_LOAD_CONFIG_DIRECTORY64_V13 PIMAGE_LOAD_CONFIG_DIRECTORY64;
1916typedef PCIMAGE_LOAD_CONFIG_DIRECTORY64_V13 PCIMAGE_LOAD_CONFIG_DIRECTORY64;
1917
1918/** @} */
1919
1920
1921/**
1922 * PE certificate directory.
1923 *
1924 * Found in IMAGE_DIRECTORY_ENTRY_SECURITY.
1925 */
1926typedef struct WIN_CERTIFICATE
1927{
1928 uint32_t dwLength;
1929 uint16_t wRevision;
1930 uint16_t wCertificateType;
1931 uint8_t bCertificate[8];
1932} WIN_CERTIFICATE;
1933AssertCompileSize(WIN_CERTIFICATE, 16);
1934typedef WIN_CERTIFICATE *PWIN_CERTIFICATE;
1935typedef WIN_CERTIFICATE const *PCWIN_CERTIFICATE;
1936
1937/** @name WIN_CERT_REVISION_XXX - Certificate data directory revision.
1938 * Used WIN_CERTIFICATE::wRevision found in the IMAGE_DIRECTORY_ENTRY_SECURITY
1939 * data directory.
1940 * @{ */
1941#define WIN_CERT_REVISION_1_0 UINT16_C(0x0100)
1942#define WIN_CERT_REVISION_2_0 UINT16_C(0x0200)
1943/** @} */
1944
1945/** @name WIN_CERT_TYPE_XXX - Signature type.
1946 * Used by WIN_CERTIFICATE::wCertificateType.
1947 * @{ */
1948#define WIN_CERT_TYPE_X509 UINT16_C(1)
1949#define WIN_CERT_TYPE_PKCS_SIGNED_DATA UINT16_C(2)
1950#define WIN_CERT_TYPE_RESERVED_1 UINT16_C(3)
1951#define WIN_CERT_TYPE_TS_STACK_SIGNED UINT16_C(4)
1952#define WIN_CERT_TYPE_EFI_PKCS115 UINT16_C(0x0ef0)
1953#define WIN_CERT_TYPE_EFI_GUID UINT16_C(0x0ef1)
1954/** @} */
1955
1956/** The alignment of the certificate table.
1957 * @remarks Found thru signtool experiments. */
1958#define WIN_CERTIFICATE_ALIGNMENT UINT32_C(8)
1959
1960
1961/**
1962 * Debug directory.
1963 *
1964 * Found in IMAGE_DIRECTORY_ENTRY_DEBUG.
1965 */
1966typedef struct _IMAGE_DEBUG_DIRECTORY
1967{
1968 uint32_t Characteristics;
1969 uint32_t TimeDateStamp;
1970 uint16_t MajorVersion;
1971 uint16_t MinorVersion;
1972 uint32_t Type;
1973 uint32_t SizeOfData;
1974 uint32_t AddressOfRawData;
1975 uint32_t PointerToRawData;
1976} IMAGE_DEBUG_DIRECTORY;
1977AssertCompileSize(IMAGE_DEBUG_DIRECTORY, 28);
1978typedef IMAGE_DEBUG_DIRECTORY *PIMAGE_DEBUG_DIRECTORY;
1979typedef IMAGE_DEBUG_DIRECTORY const *PCIMAGE_DEBUG_DIRECTORY;
1980
1981/** @name IMAGE_DEBUG_TYPE_XXX - Debug format types.
1982 * Used by IMAGE_DEBUG_DIRECTORY::Type.
1983 * @{ */
1984#define IMAGE_DEBUG_TYPE_UNKNOWN UINT32_C(0x00)
1985#define IMAGE_DEBUG_TYPE_COFF UINT32_C(0x01)
1986#define IMAGE_DEBUG_TYPE_CODEVIEW UINT32_C(0x02)
1987#define IMAGE_DEBUG_TYPE_FPO UINT32_C(0x03)
1988#define IMAGE_DEBUG_TYPE_MISC UINT32_C(0x04)
1989#define IMAGE_DEBUG_TYPE_EXCEPTION UINT32_C(0x05)
1990#define IMAGE_DEBUG_TYPE_FIXUP UINT32_C(0x06)
1991#define IMAGE_DEBUG_TYPE_OMAP_TO_SRC UINT32_C(0x07)
1992#define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC UINT32_C(0x08)
1993#define IMAGE_DEBUG_TYPE_BORLAND UINT32_C(0x09)
1994#define IMAGE_DEBUG_TYPE_RESERVED10 UINT32_C(0x0a)
1995#define IMAGE_DEBUG_TYPE_CLSID UINT32_C(0x0b)
1996#define IMAGE_DEBUG_TYPE_VC_FEATURE UINT32_C(0x0c)
1997#define IMAGE_DEBUG_TYPE_POGO UINT32_C(0x0d)
1998#define IMAGE_DEBUG_TYPE_ILTCG UINT32_C(0x0e)
1999#define IMAGE_DEBUG_TYPE_MPX UINT32_C(0x0f)
2000#define IMAGE_DEBUG_TYPE_REPRO UINT32_C(0x10)
2001/** @} */
2002
2003/** @name IMAGE_DEBUG_MISC_XXX - Misc debug data type.
2004 * Used by IMAGE_DEBUG_MISC::DataType.
2005 * @{ */
2006#define IMAGE_DEBUG_MISC_EXENAME UINT32_C(1)
2007/** @} */
2008
2009
2010/**
2011 * The format of IMAGE_DEBUG_TYPE_MISC debug info.
2012 */
2013typedef struct _IMAGE_DEBUG_MISC
2014{
2015 uint32_t DataType;
2016 uint32_t Length;
2017 uint8_t Unicode;
2018 uint8_t Reserved[3];
2019 uint8_t Data[1];
2020} IMAGE_DEBUG_MISC;
2021AssertCompileSize(IMAGE_DEBUG_MISC, 16);
2022typedef IMAGE_DEBUG_MISC *PIMAGE_DEBUG_MISC;
2023typedef IMAGE_DEBUG_MISC const *PCIMAGE_DEBUG_MISC;
2024
2025
2026
2027/**
2028 * The header of a .DBG file (NT4).
2029 */
2030typedef struct _IMAGE_SEPARATE_DEBUG_HEADER
2031{
2032 uint16_t Signature; /**< 0x00 */
2033 uint16_t Flags; /**< 0x02 */
2034 uint16_t Machine; /**< 0x04 */
2035 uint16_t Characteristics; /**< 0x06 */
2036 uint32_t TimeDateStamp; /**< 0x08 */
2037 uint32_t CheckSum; /**< 0x0c */
2038 uint32_t ImageBase; /**< 0x10 */
2039 uint32_t SizeOfImage; /**< 0x14 */
2040 uint32_t NumberOfSections; /**< 0x18 */
2041 uint32_t ExportedNamesSize; /**< 0x1c */
2042 uint32_t DebugDirectorySize; /**< 0x20 */
2043 uint32_t SectionAlignment; /**< 0x24 */
2044 uint32_t Reserved[2]; /**< 0x28 */
2045} IMAGE_SEPARATE_DEBUG_HEADER; /* size: 0x30 */
2046AssertCompileSize(IMAGE_SEPARATE_DEBUG_HEADER, 0x30);
2047typedef IMAGE_SEPARATE_DEBUG_HEADER *PIMAGE_SEPARATE_DEBUG_HEADER;
2048typedef IMAGE_SEPARATE_DEBUG_HEADER const *PCIMAGE_SEPARATE_DEBUG_HEADER;
2049
2050/** The signature of a IMAGE_SEPARATE_DEBUG_HEADER. */
2051#define IMAGE_SEPARATE_DEBUG_SIGNATURE UINT16_C(0x4944)
2052
2053
2054/**
2055 * The format of IMAGE_DEBUG_TYPE_COFF debug info.
2056 */
2057typedef struct _IMAGE_COFF_SYMBOLS_HEADER
2058{
2059 uint32_t NumberOfSymbols;
2060 uint32_t LvaToFirstSymbol;
2061 uint32_t NumberOfLinenumbers;
2062 uint32_t LvaToFirstLinenumber;
2063 uint32_t RvaToFirstByteOfCode;
2064 uint32_t RvaToLastByteOfCode;
2065 uint32_t RvaToFirstByteOfData;
2066 uint32_t RvaToLastByteOfData;
2067} IMAGE_COFF_SYMBOLS_HEADER;
2068AssertCompileSize(IMAGE_COFF_SYMBOLS_HEADER, 0x20);
2069typedef IMAGE_COFF_SYMBOLS_HEADER *PIMAGE_COFF_SYMBOLS_HEADER;
2070typedef IMAGE_COFF_SYMBOLS_HEADER const *PCIMAGE_COFF_SYMBOLS_HEADER;
2071
2072
2073/**
2074 * Line number format of IMAGE_DEBUG_TYPE_COFF debug info.
2075 *
2076 * @remarks This has misaligned members.
2077 */
2078#pragma pack(2)
2079typedef struct _IMAGE_LINENUMBER
2080{
2081 union
2082 {
2083 uint32_t VirtualAddress;
2084 uint32_t SymbolTableIndex;
2085 } Type;
2086 uint16_t Linenumber;
2087} IMAGE_LINENUMBER;
2088#pragma pack()
2089AssertCompileSize(IMAGE_LINENUMBER, 6);
2090typedef IMAGE_LINENUMBER *PIMAGE_LINENUMBER;
2091typedef IMAGE_LINENUMBER const *PCIMAGE_LINENUMBER;
2092
2093
2094/** The size of a IMAGE_SYMBOL & IMAGE_AUX_SYMBOL structure. */
2095#define IMAGE_SIZE_OF_SYMBOL 18
2096/** The size of a IMAGE_SYMBOL_EX & IMAGE_AUX_SYMBOL_EX structure. */
2097#define IMAGE_SIZE_OF_SYMBOL_EX 20
2098
2099/**
2100 * COFF symbol.
2101 */
2102#pragma pack(2)
2103typedef struct _IMAGE_SYMBOL
2104{
2105 union
2106 {
2107 uint8_t ShortName[8];
2108 struct
2109 {
2110 uint32_t Short;
2111 uint32_t Long;
2112 } Name;
2113 uint32_t LongName[2];
2114 } N;
2115
2116 uint32_t Value;
2117 int16_t SectionNumber;
2118 uint16_t Type;
2119 uint8_t StorageClass;
2120 uint8_t NumberOfAuxSymbols;
2121} IMAGE_SYMBOL;
2122#pragma pack()
2123AssertCompileSize(IMAGE_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
2124typedef IMAGE_SYMBOL *PIMAGE_SYMBOL;
2125typedef IMAGE_SYMBOL const *PCIMAGE_SYMBOL;
2126
2127/**
2128 * COFF auxiliary symbol token defintion (whatever that is).
2129 */
2130#pragma pack(2)
2131typedef struct IMAGE_AUX_SYMBOL_TOKEN_DEF
2132{
2133 uint8_t bAuxType;
2134 uint8_t bReserved;
2135 uint32_t SymbolTableIndex;
2136 uint8_t rgbReserved[12];
2137} IMAGE_AUX_SYMBOL_TOKEN_DEF;
2138#pragma pack()
2139AssertCompileSize(IMAGE_AUX_SYMBOL_TOKEN_DEF, IMAGE_SIZE_OF_SYMBOL);
2140typedef IMAGE_AUX_SYMBOL_TOKEN_DEF *PIMAGE_AUX_SYMBOL_TOKEN_DEF;
2141typedef IMAGE_AUX_SYMBOL_TOKEN_DEF const *PCIMAGE_AUX_SYMBOL_TOKEN_DEF;
2142
2143/**
2144 * COFF auxiliary symbol.
2145 */
2146#pragma pack(1)
2147typedef union _IMAGE_AUX_SYMBOL
2148{
2149 struct
2150 {
2151 uint32_t TagIndex;
2152 union
2153 {
2154 struct
2155 {
2156 uint16_t Linenumber;
2157 uint16_t Size;
2158 } LnSz;
2159 } Misc;
2160 union
2161 {
2162 struct
2163 {
2164 uint32_t PointerToLinenumber;
2165 uint32_t PointerToNextFunction;
2166 } Function;
2167 struct
2168 {
2169 uint16_t Dimension[4];
2170 } Array;
2171 } FcnAry;
2172 uint16_t TvIndex;
2173 } Sym;
2174
2175 struct
2176 {
2177 uint8_t Name[IMAGE_SIZE_OF_SYMBOL];
2178 } File;
2179
2180 struct
2181 {
2182 uint32_t Length;
2183 uint16_t NumberOfRelocations;
2184 uint16_t NumberOfLinenumbers;
2185 uint32_t CheckSum;
2186 uint16_t Number;
2187 uint8_t Selection;
2188 uint8_t bReserved;
2189 uint16_t HighNumber;
2190 } Section;
2191
2192 IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
2193 struct
2194 {
2195 uint32_t crc;
2196 uint8_t rgbReserved[14];
2197 } CRC;
2198} IMAGE_AUX_SYMBOL;
2199#pragma pack()
2200AssertCompileSize(IMAGE_AUX_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
2201typedef IMAGE_AUX_SYMBOL *PIMAGE_AUX_SYMBOL;
2202typedef IMAGE_AUX_SYMBOL const *PCIMAGE_AUX_SYMBOL;
2203
2204
2205/**
2206 * Extended COFF symbol.
2207 */
2208typedef struct _IMAGE_SYMBOL_EX
2209{
2210 union
2211 {
2212 uint8_t ShortName[8];
2213 struct
2214 {
2215 uint32_t Short;
2216 uint32_t Long;
2217 } Name;
2218 uint32_t LongName[2];
2219 } N;
2220
2221 uint32_t Value;
2222 int32_t SectionNumber; /* The difference from IMAGE_SYMBOL */
2223 uint16_t Type;
2224 uint8_t StorageClass;
2225 uint8_t NumberOfAuxSymbols;
2226} IMAGE_SYMBOL_EX;
2227AssertCompileSize(IMAGE_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
2228typedef IMAGE_SYMBOL_EX *PIMAGE_SYMBOL_EX;
2229typedef IMAGE_SYMBOL_EX const *PCIMAGE_SYMBOL_EX;
2230
2231/**
2232 * Extended COFF auxiliary symbol.
2233 */
2234typedef union _IMAGE_AUX_SYMBOL_EX
2235{
2236 struct
2237 {
2238 uint32_t WeakDefaultSymIndex;
2239 uint32_t WeakSearchType;
2240 uint8_t rgbReserved[12];
2241 } Sym;
2242
2243 struct
2244 {
2245 uint8_t Name[IMAGE_SIZE_OF_SYMBOL_EX];
2246 } File;
2247
2248 struct
2249 {
2250 uint32_t Length;
2251 uint16_t NumberOfRelocations;
2252 uint16_t NumberOfLinenumbers;
2253 uint32_t CheckSum;
2254 uint16_t Number;
2255 uint8_t Selection;
2256 uint8_t bReserved;
2257 uint16_t HighNumber;
2258 uint8_t rgbReserved[2];
2259 } Section;
2260
2261 IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
2262
2263 struct
2264 {
2265 uint32_t crc;
2266 uint8_t rgbReserved[16];
2267 } CRC;
2268} IMAGE_AUX_SYMBOL_EX;
2269AssertCompileSize(IMAGE_AUX_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
2270typedef IMAGE_AUX_SYMBOL_EX *PIMAGE_AUX_SYMBOL_EX;
2271typedef IMAGE_AUX_SYMBOL_EX const *PCIMAGE_AUX_SYMBOL_EX;
2272
2273/** @name Special COFF section numbers.
2274 * Used by IMAGE_SYMBOL::SectionNumber and IMAGE_SYMBOL_EX::SectionNumber
2275 * @{ */
2276#define IMAGE_SYM_UNDEFINED INT16_C(0)
2277#define IMAGE_SYM_ABSOLUTE INT16_C(-1)
2278#define IMAGE_SYM_DEBUG INT16_C(-2)
2279/** @} */
2280
2281/** @name IMAGE_SYM_CLASS_XXX - COFF symbol storage classes.
2282 * @{ */
2283#define IMAGE_SYM_CLASS_END_OF_FUNCTION UINT8_C(0xff) /* -1 */
2284#define IMAGE_SYM_CLASS_NULL UINT8_C(0)
2285#define IMAGE_SYM_CLASS_AUTOMATIC UINT8_C(1)
2286#define IMAGE_SYM_CLASS_EXTERNAL UINT8_C(2)
2287#define IMAGE_SYM_CLASS_STATIC UINT8_C(3)
2288#define IMAGE_SYM_CLASS_REGISTER UINT8_C(4)
2289#define IMAGE_SYM_CLASS_EXTERNAL_DEF UINT8_C(5)
2290#define IMAGE_SYM_CLASS_LABEL UINT8_C(6)
2291#define IMAGE_SYM_CLASS_UNDEFINED_LABEL UINT8_C(7)
2292#define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT UINT8_C(8)
2293#define IMAGE_SYM_CLASS_ARGUMENT UINT8_C(9)
2294#define IMAGE_SYM_CLASS_STRUCT_TAG UINT8_C(10)
2295#define IMAGE_SYM_CLASS_MEMBER_OF_UNION UINT8_C(11)
2296#define IMAGE_SYM_CLASS_UNION_TAG UINT8_C(12)
2297#define IMAGE_SYM_CLASS_TYPE_DEFINITION UINT8_C(13)
2298#define IMAGE_SYM_CLASS_UNDEFINED_STATIC UINT8_C(14)
2299#define IMAGE_SYM_CLASS_ENUM_TAG UINT8_C(15)
2300#define IMAGE_SYM_CLASS_MEMBER_OF_ENUM UINT8_C(16)
2301#define IMAGE_SYM_CLASS_REGISTER_PARAM UINT8_C(17)
2302#define IMAGE_SYM_CLASS_BIT_FIELD UINT8_C(18)
2303#define IMAGE_SYM_CLASS_FAR_EXTERNAL UINT8_C(68)
2304#define IMAGE_SYM_CLASS_BLOCK UINT8_C(100)
2305#define IMAGE_SYM_CLASS_FUNCTION UINT8_C(101)
2306#define IMAGE_SYM_CLASS_END_OF_STRUCT UINT8_C(102)
2307#define IMAGE_SYM_CLASS_FILE UINT8_C(103)
2308#define IMAGE_SYM_CLASS_SECTION UINT8_C(104)
2309#define IMAGE_SYM_CLASS_WEAK_EXTERNAL UINT8_C(105)
2310#define IMAGE_SYM_CLASS_CLR_TOKEN UINT8_C(107)
2311/** @} */
2312
2313/** @name IMAGE_SYM_TYPE_XXX - COFF symbol base types
2314 * @{ */
2315#define IMAGE_SYM_TYPE_NULL UINT16_C(0x0000)
2316#define IMAGE_SYM_TYPE_VOID UINT16_C(0x0001)
2317#define IMAGE_SYM_TYPE_CHAR UINT16_C(0x0002)
2318#define IMAGE_SYM_TYPE_SHORT UINT16_C(0x0003)
2319#define IMAGE_SYM_TYPE_INT UINT16_C(0x0004)
2320#define IMAGE_SYM_TYPE_LONG UINT16_C(0x0005)
2321#define IMAGE_SYM_TYPE_FLOAT UINT16_C(0x0006)
2322#define IMAGE_SYM_TYPE_DOUBLE UINT16_C(0x0007)
2323#define IMAGE_SYM_TYPE_STRUCT UINT16_C(0x0008)
2324#define IMAGE_SYM_TYPE_UNION UINT16_C(0x0009)
2325#define IMAGE_SYM_TYPE_ENUM UINT16_C(0x000a)
2326#define IMAGE_SYM_TYPE_MOE UINT16_C(0x000b)
2327#define IMAGE_SYM_TYPE_BYTE UINT16_C(0x000c)
2328#define IMAGE_SYM_TYPE_WORD UINT16_C(0x000d)
2329#define IMAGE_SYM_TYPE_UINT UINT16_C(0x000e)
2330#define IMAGE_SYM_TYPE_DWORD UINT16_C(0x000f)
2331#define IMAGE_SYM_TYPE_PCODE UINT16_C(0x8000)
2332/** @} */
2333
2334/** @name IMAGE_SYM_DTYPE_XXX - COFF symbol complex types
2335 * @{ */
2336#define IMAGE_SYM_DTYPE_NULL UINT16_C(0x0)
2337#define IMAGE_SYM_DTYPE_POINTER UINT16_C(0x1)
2338#define IMAGE_SYM_DTYPE_FUNCTION UINT16_C(0x2)
2339#define IMAGE_SYM_DTYPE_ARRAY UINT16_C(0x3)
2340/** @} */
2341
2342/** @name COFF Symbol type masks and shift counts.
2343 * @{ */
2344#define N_BTMASK UINT16_C(0x000f)
2345#define N_TMASK UINT16_C(0x0030)
2346#define N_TMASK1 UINT16_C(0x00c0)
2347#define N_TMASK2 UINT16_C(0x00f0)
2348#define N_BTSHFT 4
2349#define N_TSHIFT 2
2350/** @} */
2351
2352/** @name COFF Symbol type macros.
2353 * @{ */
2354#define BTYPE(a_Type) ( (a_Type) & N_BTMASK )
2355#define ISPTR(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_POINTER << N_BTSHFT) )
2356#define ISFCN(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_FUNCTION << N_BTSHFT) )
2357#define ISARY(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_ARRAY << N_BTSHFT) )
2358#define ISTAG(a_StorageClass) ( (a_StorageClass) == IMAGE_SYM_CLASS_STRUCT_TAG \
2359 || (a_StorageClass) == IMAGE_SYM_CLASS_UNION_TAG \
2360 || (a_StorageClass) == IMAGE_SYM_CLASS_ENUM_TAG )
2361/** @} */
2362
2363
2364/**
2365 * COFF relocation table entry.
2366 *
2367 * @note The size of the structure is not a multiple of the largest member
2368 * (uint32_t), so odd relocation table entry members will have
2369 * misaligned uint32_t members.
2370 */
2371#pragma pack(1)
2372typedef struct _IMAGE_RELOCATION
2373{
2374 union
2375 {
2376 uint32_t VirtualAddress;
2377 uint32_t RelocCount;
2378 } u;
2379 uint32_t SymbolTableIndex;
2380 uint16_t Type;
2381} IMAGE_RELOCATION;
2382#pragma pack()
2383/** The size of a COFF relocation entry. */
2384#define IMAGE_SIZEOF_RELOCATION 10
2385AssertCompileSize(IMAGE_RELOCATION, IMAGE_SIZEOF_RELOCATION);
2386typedef IMAGE_RELOCATION *PIMAGE_RELOCATION;
2387typedef IMAGE_RELOCATION const *PCIMAGE_RELOCATION;
2388
2389
2390/** @name IMAGE_REL_AMD64_XXX - COFF relocations for AMD64 CPUs.
2391 * Used by IMAGE_RELOCATION::Type.
2392 * @{ */
2393#define IMAGE_REL_AMD64_ABSOLUTE UINT16_C(0x0000)
2394#define IMAGE_REL_AMD64_ADDR64 UINT16_C(0x0001)
2395#define IMAGE_REL_AMD64_ADDR32 UINT16_C(0x0002)
2396#define IMAGE_REL_AMD64_ADDR32NB UINT16_C(0x0003)
2397#define IMAGE_REL_AMD64_REL32 UINT16_C(0x0004)
2398#define IMAGE_REL_AMD64_REL32_1 UINT16_C(0x0005)
2399#define IMAGE_REL_AMD64_REL32_2 UINT16_C(0x0006)
2400#define IMAGE_REL_AMD64_REL32_3 UINT16_C(0x0007)
2401#define IMAGE_REL_AMD64_REL32_4 UINT16_C(0x0008)
2402#define IMAGE_REL_AMD64_REL32_5 UINT16_C(0x0009)
2403#define IMAGE_REL_AMD64_SECTION UINT16_C(0x000a)
2404#define IMAGE_REL_AMD64_SECREL UINT16_C(0x000b)
2405#define IMAGE_REL_AMD64_SECREL7 UINT16_C(0x000c)
2406#define IMAGE_REL_AMD64_TOKEN UINT16_C(0x000d)
2407#define IMAGE_REL_AMD64_SREL32 UINT16_C(0x000e)
2408#define IMAGE_REL_AMD64_PAIR UINT16_C(0x000f)
2409#define IMAGE_REL_AMD64_SSPAN32 UINT16_C(0x0010)
2410/** @} */
2411
2412/** @name ARM IMAGE_REL_ARM_XXX - COFF relocations for ARM CPUs.
2413 * Used by IMAGE_RELOCATION::Type.
2414 * @{ */
2415#define IMAGE_REL_ARM_ABSOLUTE UINT16_C(0x0000)
2416#define IMAGE_REL_ARM_ADDR32 UINT16_C(0x0001)
2417#define IMAGE_REL_ARM_ADDR32NB UINT16_C(0x0002)
2418#define IMAGE_REL_ARM_BRANCH24 UINT16_C(0x0003)
2419#define IMAGE_REL_ARM_BRANCH11 UINT16_C(0x0004)
2420#define IMAGE_REL_ARM_TOKEN UINT16_C(0x0005)
2421#define IMAGE_REL_ARM_BLX24 UINT16_C(0x0008)
2422#define IMAGE_REL_ARM_BLX11 UINT16_C(0x0009)
2423#define IMAGE_REL_ARM_SECTION UINT16_C(0x000e)
2424#define IMAGE_REL_ARM_SECREL UINT16_C(0x000f)
2425#define IMAGE_REL_ARM_MOV32A UINT16_C(0x0010)
2426#define IMAGE_REL_ARM_MOV32T UINT16_C(0x0011)
2427#define IMAGE_REL_ARM_BRANCH20T UINT16_C(0x0012)
2428#define IMAGE_REL_ARM_BRANCH24T UINT16_C(0x0014)
2429#define IMAGE_REL_ARM_BLX23T UINT16_C(0x0015)
2430/** @} */
2431
2432/** @name IMAGE_REL_ARM64_XXX - COFF relocations for ARMv8 CPUs (64-bit).
2433 * Used by IMAGE_RELOCATION::Type.
2434 * @{ */
2435#define IMAGE_REL_ARM64_ABSOLUTE UINT16_C(0x0000)
2436#define IMAGE_REL_ARM64_ADDR32 UINT16_C(0x0001)
2437#define IMAGE_REL_ARM64_ADDR32NB UINT16_C(0x0002)
2438#define IMAGE_REL_ARM64_BRANCH26 UINT16_C(0x0003)
2439#define IMAGE_REL_ARM64_PAGEBASE_REL21 UINT16_C(0x0004)
2440#define IMAGE_REL_ARM64_REL21 UINT16_C(0x0005)
2441#define IMAGE_REL_ARM64_PAGEOFFSET_12A UINT16_C(0x0006)
2442#define IMAGE_REL_ARM64_PAGEOFFSET_12L UINT16_C(0x0007)
2443#define IMAGE_REL_ARM64_SECREL UINT16_C(0x0008)
2444#define IMAGE_REL_ARM64_SECREL_LOW12A UINT16_C(0x0009)
2445#define IMAGE_REL_ARM64_SECREL_HIGH12A UINT16_C(0x000a)
2446#define IMAGE_REL_ARM64_SECREL_LOW12L UINT16_C(0x000b)
2447#define IMAGE_REL_ARM64_TOKEN UINT16_C(0x000c)
2448#define IMAGE_REL_ARM64_SECTION UINT16_C(0x000d)
2449#define IMAGE_REL_ARM64_ADDR64 UINT16_C(0x000e)
2450/** @} */
2451
2452/** @name IMAGE_REL_SH3_XXX - COFF relocation for Hitachi SuperH CPUs.
2453 * Used by IMAGE_RELOCATION::Type.
2454 * @{ */
2455#define IMAGE_REL_SH3_ABSOLUTE UINT16_C(0x0000)
2456#define IMAGE_REL_SH3_DIRECT16 UINT16_C(0x0001)
2457#define IMAGE_REL_SH3_DIRECT32 UINT16_C(0x0002)
2458#define IMAGE_REL_SH3_DIRECT8 UINT16_C(0x0003)
2459#define IMAGE_REL_SH3_DIRECT8_WORD UINT16_C(0x0004)
2460#define IMAGE_REL_SH3_DIRECT8_LONG UINT16_C(0x0005)
2461#define IMAGE_REL_SH3_DIRECT4 UINT16_C(0x0006)
2462#define IMAGE_REL_SH3_DIRECT4_WORD UINT16_C(0x0007)
2463#define IMAGE_REL_SH3_DIRECT4_LONG UINT16_C(0x0008)
2464#define IMAGE_REL_SH3_PCREL8_WORD UINT16_C(0x0009)
2465#define IMAGE_REL_SH3_PCREL8_LONG UINT16_C(0x000a)
2466#define IMAGE_REL_SH3_PCREL12_WORD UINT16_C(0x000b)
2467#define IMAGE_REL_SH3_STARTOF_SECTION UINT16_C(0x000c)
2468#define IMAGE_REL_SH3_SIZEOF_SECTION UINT16_C(0x000d)
2469#define IMAGE_REL_SH3_SECTION UINT16_C(0x000e)
2470#define IMAGE_REL_SH3_SECREL UINT16_C(0x000f)
2471#define IMAGE_REL_SH3_DIRECT32_NB UINT16_C(0x0010)
2472#define IMAGE_REL_SH3_GPREL4_LONG UINT16_C(0x0011)
2473#define IMAGE_REL_SH3_TOKEN UINT16_C(0x0012)
2474#define IMAGE_REL_SHM_PCRELPT UINT16_C(0x0013)
2475#define IMAGE_REL_SHM_REFLO UINT16_C(0x0014)
2476#define IMAGE_REL_SHM_REFHALF UINT16_C(0x0015)
2477#define IMAGE_REL_SHM_RELLO UINT16_C(0x0016)
2478#define IMAGE_REL_SHM_RELHALF UINT16_C(0x0017)
2479#define IMAGE_REL_SHM_PAIR UINT16_C(0x0018)
2480#define IMAGE_REL_SHM_NOMODE UINT16_C(0x8000)
2481/** @} */
2482
2483/** @name IMAGE_REL_PPC_XXX - COFF relocations for IBM PowerPC CPUs.
2484 * Used by IMAGE_RELOCATION::Type.
2485 * @{ */
2486#define IMAGE_REL_PPC_ABSOLUTE UINT16_C(0x0000)
2487#define IMAGE_REL_PPC_ADDR64 UINT16_C(0x0001)
2488#define IMAGE_REL_PPC_ADDR32 UINT16_C(0x0002)
2489#define IMAGE_REL_PPC_ADDR24 UINT16_C(0x0003)
2490#define IMAGE_REL_PPC_ADDR16 UINT16_C(0x0004)
2491#define IMAGE_REL_PPC_ADDR14 UINT16_C(0x0005)
2492#define IMAGE_REL_PPC_REL24 UINT16_C(0x0006)
2493#define IMAGE_REL_PPC_REL14 UINT16_C(0x0007)
2494#define IMAGE_REL_PPC_ADDR32NB UINT16_C(0x000a)
2495#define IMAGE_REL_PPC_SECREL UINT16_C(0x000b)
2496#define IMAGE_REL_PPC_SECTION UINT16_C(0x000c)
2497#define IMAGE_REL_PPC_SECREL16 UINT16_C(0x000f)
2498#define IMAGE_REL_PPC_REFHI UINT16_C(0x0010)
2499#define IMAGE_REL_PPC_REFLO UINT16_C(0x0011)
2500#define IMAGE_REL_PPC_PAIR UINT16_C(0x0012)
2501#define IMAGE_REL_PPC_SECRELLO UINT16_C(0x0013)
2502#define IMAGE_REL_PPC_GPREL UINT16_C(0x0015)
2503#define IMAGE_REL_PPC_TOKEN UINT16_C(0x0016)
2504/** @} */
2505
2506/** @name IMAGE_REL_I386_XXX - COFF relocations for x86 CPUs.
2507 * Used by IMAGE_RELOCATION::Type.
2508 * @{ */
2509#define IMAGE_REL_I386_ABSOLUTE UINT16_C(0x0000)
2510#define IMAGE_REL_I386_DIR16 UINT16_C(0x0001)
2511#define IMAGE_REL_I386_REL16 UINT16_C(0x0002)
2512#define IMAGE_REL_I386_DIR32 UINT16_C(0x0006)
2513#define IMAGE_REL_I386_DIR32NB UINT16_C(0x0007)
2514#define IMAGE_REL_I386_SEG12 UINT16_C(0x0009)
2515#define IMAGE_REL_I386_SECTION UINT16_C(0x000A)
2516#define IMAGE_REL_I386_SECREL UINT16_C(0x000B)
2517#define IMAGE_REL_I386_TOKEN UINT16_C(0x000C)
2518#define IMAGE_REL_I386_SECREL7 UINT16_C(0x000D)
2519#define IMAGE_REL_I386_REL32 UINT16_C(0x0014)
2520/** @} */
2521
2522/** @name IMAGE_REL_IA64_XXX - COFF relocations for "Itanic" CPUs.
2523 * @{ */
2524#define IMAGE_REL_IA64_ABSOLUTE UINT16_C(0x0000)
2525#define IMAGE_REL_IA64_IMM14 UINT16_C(0x0001)
2526#define IMAGE_REL_IA64_IMM22 UINT16_C(0x0002)
2527#define IMAGE_REL_IA64_IMM64 UINT16_C(0x0003)
2528#define IMAGE_REL_IA64_DIR32 UINT16_C(0x0004)
2529#define IMAGE_REL_IA64_DIR64 UINT16_C(0x0005)
2530#define IMAGE_REL_IA64_PCREL21B UINT16_C(0x0006)
2531#define IMAGE_REL_IA64_PCREL21M UINT16_C(0x0007)
2532#define IMAGE_REL_IA64_PCREL21F UINT16_C(0x0008)
2533#define IMAGE_REL_IA64_GPREL22 UINT16_C(0x0009)
2534#define IMAGE_REL_IA64_LTOFF22 UINT16_C(0x000a)
2535#define IMAGE_REL_IA64_SECTION UINT16_C(0x000b)
2536#define IMAGE_REL_IA64_SECREL22 UINT16_C(0x000c)
2537#define IMAGE_REL_IA64_SECREL64I UINT16_C(0x000d)
2538#define IMAGE_REL_IA64_SECREL32 UINT16_C(0x000e)
2539#define IMAGE_REL_IA64_DIR32NB UINT16_C(0x0010)
2540#define IMAGE_REL_IA64_SREL14 UINT16_C(0x0011)
2541#define IMAGE_REL_IA64_SREL22 UINT16_C(0x0012)
2542#define IMAGE_REL_IA64_SREL32 UINT16_C(0x0013)
2543#define IMAGE_REL_IA64_UREL32 UINT16_C(0x0014)
2544#define IMAGE_REL_IA64_PCREL60X UINT16_C(0x0015)
2545#define IMAGE_REL_IA64_PCREL60B UINT16_C(0x0016)
2546#define IMAGE_REL_IA64_PCREL60F UINT16_C(0x0017)
2547#define IMAGE_REL_IA64_PCREL60I UINT16_C(0x0018)
2548#define IMAGE_REL_IA64_PCREL60M UINT16_C(0x0019)
2549#define IMAGE_REL_IA64_IMMGPREL64 UINT16_C(0x001a)
2550#define IMAGE_REL_IA64_TOKEN UINT16_C(0x001b)
2551#define IMAGE_REL_IA64_GPREL32 UINT16_C(0x001c)
2552#define IMAGE_REL_IA64_ADDEND UINT16_C(0x001f)
2553/** @} */
2554
2555/** @name IMAGE_REL_MIPS_XXX - COFF relocations for MIPS CPUs.
2556 * Used by IMAGE_RELOCATION::Type.
2557 * @{ */
2558#define IMAGE_REL_MIPS_ABSOLUTE UINT16_C(0x0000)
2559#define IMAGE_REL_MIPS_REFHALF UINT16_C(0x0001)
2560#define IMAGE_REL_MIPS_REFWORD UINT16_C(0x0002)
2561#define IMAGE_REL_MIPS_JMPADDR UINT16_C(0x0003)
2562#define IMAGE_REL_MIPS_REFHI UINT16_C(0x0004)
2563#define IMAGE_REL_MIPS_REFLO UINT16_C(0x0005)
2564#define IMAGE_REL_MIPS_GPREL UINT16_C(0x0006)
2565#define IMAGE_REL_MIPS_LITERAL UINT16_C(0x0007)
2566#define IMAGE_REL_MIPS_SECTION UINT16_C(0x000a)
2567#define IMAGE_REL_MIPS_SECREL UINT16_C(0x000b)
2568#define IMAGE_REL_MIPS_SECRELLO UINT16_C(0x000c)
2569#define IMAGE_REL_MIPS_SECRELHI UINT16_C(0x000d)
2570#define IMAGE_REL_MIPS_JMPADDR16 UINT16_C(0x0010)
2571#define IMAGE_REL_MIPS_REFWORDNB UINT16_C(0x0022)
2572#define IMAGE_REL_MIPS_PAIR UINT16_C(0x0025)
2573/** @} */
2574
2575/** @name IMAGE_REL_M32R_XXX - COFF relocations for Mitsubishi M32R CPUs.
2576 * Used by IMAGE_RELOCATION::Type.
2577 * @{ */
2578#define IMAGE_REL_M32R_ABSOLUTE UINT16_C(0x0000)
2579#define IMAGE_REL_M32R_ADDR32 UINT16_C(0x0001)
2580#define IMAGE_REL_M32R_ADDR32NB UINT16_C(0x0002)
2581#define IMAGE_REL_M32R_ADDR24 UINT16_C(0x0003)
2582#define IMAGE_REL_M32R_GPREL16 UINT16_C(0x0004)
2583#define IMAGE_REL_M32R_PCREL24 UINT16_C(0x0005)
2584#define IMAGE_REL_M32R_PCREL16 UINT16_C(0x0006)
2585#define IMAGE_REL_M32R_PCREL8 UINT16_C(0x0007)
2586#define IMAGE_REL_M32R_REFHALF UINT16_C(0x0008)
2587#define IMAGE_REL_M32R_REFHI UINT16_C(0x0009)
2588#define IMAGE_REL_M32R_REFLO UINT16_C(0x000a)
2589#define IMAGE_REL_M32R_PAIR UINT16_C(0x000b)
2590#define IMAGE_REL_M32R_SECTION UINT16_C(0x000c)
2591#define IMAGE_REL_M32R_SECREL UINT16_C(0x000d)
2592#define IMAGE_REL_M32R_TOKEN UINT16_C(0x000e)
2593/** @} */
2594
2595
2596/** @} */
2597
2598#endif /* !IPRT_INCLUDED_formats_pecoff_h */
2599
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette